UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

May 2, 2012

MEMORANDUM TO: R. W. Borchardt

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S MANAGEMENT OF THE BASELINE 

SECURITY INSPECTION PROGRAM (OIG-12-A-10)

REFERENCE: DEPUTY EXECUTIVE DIRECTOR FOR REACTOR AND 

PREPAREDNESS PROGRAMS, MEMORANDUM DATED

APRIL 10, 2012 

Attached is the Office of the Inspector General’s (OIG) analysis and status of the 

recommendations as discussed in the agency’s response dated April 10, 2012. Based 

on this response, recommendations 1, 2, 3, 4, and 5 are in resolved status. Please 

provide an updated status of the resolved recommendations by November 2, 2012.

If you have any questions or concerns, please call me at 415-5915 or Beth Serepca, 

Team Leader, at 415-5911.

Attachment: As stated

cc: N. Mamish, OEDO

K. Brock, OEDO

J. Arildsen, OEDO

C. Jaegers, OEDO 
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 1: Develop and maintain a centralized database of security 

findings data to be used for evaluating licensee performance 

trends, and communicating this information to NRC staff, 

industry, and appropriate public stakeholders.

Agency Response

Dated April 10, 2012: Agree. To ensure an adequate database is constructed, the 

Office of Nuclear Security and Incident Response (NSIR) will 

confirm its data needs regarding the type of data to be 

collected and the method for sorting the data. The 

confirmation will ensure the staff appropriately establishes a 

database that provides a systematic analysis to assess the 

trends across NRC regions and/or licensee fleets. The 

centralized database will be developed and available for full 

implementation by October 2013. The NSIR point of contact 

is Shyrl Coker.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation when 

OIG staff have reviewed documentation of NSIR’s data 

collection and analysis procedures, and have verified that 

the centralized security database functions as intended in 

accordance with Recommendation 1. 

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 2: Formalize and implement a process for maintaining current 

and accurate data within a centralized database.

Agency Response

Dated April 10, 2012: Agree. NSIR will establish and implement an NSIR office 

procedure to ensure data from the security inspection 

reports is included in a centralized database. NSIR expects 

to have the formal procedure in place for maintaining current 

and accurate security findings data by the first quarter of 

Calendar Year (CY) 2013. The NSIR point of contact is 

Shyrl Coker.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff have reviewed NSIR’s new office procedure for 

maintaining current and accurate security findings data in a 

centralized database and have verified implementation of

this new guidance.

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 3: Formalize and implement a process for ensuring Safeguards 

Information (SGI) findings data is current and accessible for 

use in trending security findings issues.

Agency Response

Dated April 10, 2012: Agree. NSIR will include instructions in the NSIR office 

procedure, established and implemented for 

Recommendation 2 of this report, to ensure that SGI findings 

are categorized and put into a centralized database by the 

first quarter of CY 2013. The NSIR point of contact is Shyrl 

Coker.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff have verified that the NSIR office procedure 

referenced under Recommendation 2 contains instructions 

specific to SGI findings data and have confirmed 

implementation of this new office procedure in accordance 

with Recommendation 2.

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 4: Formalize and implement procedures for testing draft 

Significance Determination Process (SDP) tools by staff to 

determine how draft tools would screen past violations 

and/or hypothetical security violations.

Agency Response

Dated April 10, 2012: Agree. NSIR has historically implemented the practice of 

testing draft SDP tools, notwithstanding the one instance in 

CY 2008 when NSIR missed an opportunity to test a draft 

SDP tool. To ensure a consistent application of changes to 

SDP assessment tools is implemented by the staff, NSIR will 

develop an office procedure to formalize the testing of draft 

SDP tools in accordance with the Reactor Oversight 

Process. The procedure will include the testing and 

screening of past security violations and/or hypothetical 

security violations. NSIR expects to have the formal 

procedure in place by the first quarter of CY 2013. The

NSIR point of contact is F. Paul Peduzzi.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff have reviewed NSIR’s office procedure for testing 

draft SDP tools and verified implementation of this new 

guidance.

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 5: Formalize and implement a process for performing periodic 

review of existing security SDP tools to check for 

consistency of application and results.

Agency Response

Dated April 10, 2012: Agree. IMC 0307, “Reactor Oversight Process [ROP] SelfAssessment Program,” states that the ROP consists of 

inspections, performance indicators, SDPs, assessment, and 

enforcement. It is important that the ROP be periodically 

evaluated and improved when necessary to ensure 

continued achievement of its specified goals and intended 

outcomes. This is accomplished through the evaluation of 

performance metrics, one of which is designated as the 

SDP. This Metric is identified in IMC 0307,”Reactor 

Oversight Process Self-Assessment Metrics.” 

NSIR shall incorporate language into Appendix E of IMC 

0609, “Physical Protection Significance Determination 

Process for Power Reactors,” that directs the annual audit of 

the security SDP and associated tools to ensure the 

consistent application of the SDP and SDP results. This 

language shall direct staff to perform this audit in accordance 

with IMC 0307, Appendix A. The action for this 

recommendation will be completed by the end of CY 2012. 

The NSIR point of contact is F. Paul Peduzzi.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff have reviewed the updated version of IMC 0609, 

Appendix E, to ensure that it aligns with IMC 0307, Appendix 

A, and have verified that annual audits of security SDP tools 

are performed in accordance with this updated guidance.

Status: Resolved.