UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

July 9, 2013

MEMORANDUM TO: R. W. Borchardt

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S MANAGEMENT OF THE BASELINE 

SECURITY INSPECTION PROGRAM (OIG-12-A-10)

REFERENCE: DIRECTOR, OFFICE OF NUCLEAR SECURITY AND 

INCIDENT RESPONSE, MEMORANDUM DATED 

JUNE 27, 2013 

Attached is the Office of the Inspector General’s (OIG) analysis and status of the 

recommendations as discussed in the agency’s response dated June 27, 2013. Based 

on this response, recommendation 5 is now closed. Recommendations 1, 2, 3, and 4 

remain in resolved status. Please provide an updated status of the resolved 

recommendations by June 30, 2014.

If you have any questions or concerns, please call me at 415-5915 or Beth Serepca, 

Team Leader, at 415-5911.

Attachment: As stated

cc: R. Mitchell, OEDO

K. Brock, OEDO

J. Arildsen, OEDO

C. Jaegers, OEDO 
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 1: Develop and maintain a centralized database of security 

findings data to be used for evaluating licensee performance 

trends, and communicating this information to NRC staff, 

industry, and appropriate public stakeholders.

Agency Response

Dated June 27, 2013: To ensure an adequate database is constructed, the Office 

of Nuclear Security and Incident Response (NSIR) continues 

to confirm its data needs regarding the type of data to be 

collected and the method for sorting the data. This 

confirmation will ensure the staff appropriately establishes a 

database that provides a systematic analysis to assess 

trends across NRC regions and/or licensee fleets. NSIR has 

determined it would be prudent to combine its efforts with the 

Reactor Planning System (RPS) Replacement Team (a 

currently funded project) to develop, establish, and maintain 

a centralized database of security findings data.

NSIR has coordinated with the RPS Replacement Team to 

establish a database to collect the data points for tracking 

and trending security inspection findings. The inspectors will 

be required to input their data directly into the RPS 

Replacement System. As the RPS Replacement Project 

develops, or as soon as it is feasible, NSIR will implement a 

process to ensure accuracy of the data. The date for the 

centralized database will therefore be moved to calendar 

year (CY) 2015, in conjunction with the finalization of the 

RPS Replacement Project.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation when 

OIG staff has reviewed documentation of NSIR’s data 

collection and analysis procedures, and has verified that the 

centralized security database functions as intended in 

accordance with Recommendation 1. 

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 2: Formalize and implement a process for maintaining current 

and accurate data within a centralized database.

Agency Response

Dated June 27, 2013: NSIR will develop an office procedure to ensure data from 

the security inspection reports will be included in a 

centralized database. NSIR expects to have the formal 

procedure in place for maintaining current and accurate 

security findings data by CY 2015 in conjunction with the 

finalization of the database discussed in the “status” of 

actions with respect to Recommendation 1.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff has reviewed NSIR’s new office procedure for 

maintaining current and accurate security findings data in a 

centralized database and has verified implementation of this 

new guidance. 

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 3: Formalize and implement a process for ensuring Safeguards 

Information (SGI) findings data is current and accessible for 

use in trending security findings issues.

Agency Response

Dated June 27, 2013: As discussed in the “status” of actions with respect to 

Recommendation 2, NSIR will develop an office procedure 

to ensure that SGI findings are categorized and put into a 

centralized database. NSIR expects to have the instructions 

for SGI findings completed and added to the office 

procedure by the third quarter of CY 2015 in conjunction with 

the finalization of the database discussed in the “status” of 

actions with respect to Recommendation 1.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff has verified that the NSIR office procedure 

referenced under Recommendation 2 contains instructions 

specific to SGI findings data and has confirmed 

implementation of this new office procedure in accordance 

with Recommendation 2.

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 4: Formalize and implement procedures for testing draft 

Significance Determination Process (SDP) tools by staff to 

determine how draft tools would screen past violations 

and/or hypothetical security violations.

Agency Response

Dated June 27, 2013: As stated in the October 24, 2012, memorandum from 

James T. Wiggins, Director, NSIR, to Stephen Dingbaum, 

Assistant Inspector General for Audits, Office of the 

Inspector General, NSIR developed an office procedure to 

formalize the testing of draft SDP tools in accordance with 

the Reactor Oversight Process (ROP). Since that time, 

NSIR has met with the Office of Nuclear Reactor Regulation 

(NRR) and both NSIR and NRR agree that Inspection 

Manual Chapter (IMC) 0609 should be revised to incorporate 

the guidance contained in the NSIR office procedure since 

IMC 0609 applies to all seven cornerstones of the ROP. As 

a result, on April 26, 2013, NSIR submitted ROP Feedback 

Form (ROPFF) 0609-1894, and NRR has agreed to 

incorporate NSIR’s recommendations into the revision of 

IMC 0609. A final resolution of ROPFF-0609-1894 is 

scheduled for July 2013, and the target date to issue the 

revised IMC 0690 is January 2014, as there are several 

other significant concurrent guidance revisions in progress.

Currently, IMC 0609, Section 07.02, provides guidance on 

the development and testing of a draft SDP tool (i.e., a newly 

developed SDP tool should receive internal and external 

stakeholder review as appropriate; a feasibility review should 

be completed; all stakeholder feedback should be properly 

dispositioned; and training shall be completed prior to final 

issuance). Consistent with OIG’s Recommendation 4, this 

guidance will be augmented to provide for “testing,” of draft 

SDP tools across all ROP cornerstones (including the 

Security cornerstone). NSIR will incorporate the augmented 

IMC guidance into an office procedure by reference. 
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 4 (cont.):

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff has reviewed NSIR’s office procedure for testing 

draft SDP tools and verified implementation of this new 

guidance.

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 5: Formalize and implement a process for performing periodic 

review of existing security SDP tools to check for 

consistency of application and results.

Agency Response

Dated June 27, 2013: Complete. Inspection Manual Chapter (IMC) 0307, “Reactor 

Oversight Process (ROP) Self-Assessment Program,” states 

that the ROP consists of inspections, performance 

indicators, SDPs, assessment, and enforcement. It is 

important that the ROP be periodically evaluated and 

improved when necessary to ensure continued achievement 

of its specified goals and intended outcomes. This is 

accomplished through the evaluation of performance 

metrics, one of which is designated as the SDP. This Metric 

is identified in IMC 0307, “Reactor Oversight Process 

Self-Assessment Metrics.”

NSIR recommended a change through NRR to Appendix E 

of IMC 0609, “Physical Protection Significance 

Determination Process for Power Reactors,” that directs an 

annual audit of the security SDP and associated tools to 

ensure the consistent application of the SDP and SDP 

results. This change directs staff to perform this audit in 

accordance with IMC 0307, Appendix A. NRR accepted the 

change and updated Appendix E of IMC 0609 accordingly. 

The action for this recommendation is complete (See 

ML12335A203 – Refer to Section 0609, Appendix E-7, 

Physical Protection Significance Determination Process for 

Power Reactors issued November 30, 2012).

OIG Analysis: OIG staff reviewed the updated guidance and verified that a 

process for performing periodic review of existing security 

SDP tools to check for consistency of application and results

has been formalized and implemented.

Status: Closed.