UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

February 2, 2015

MEMORANDUM TO: Mark A. Satorius 

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S MANAGEMENT OF THE BASELINE 

SECURITY INSPECTION PROGRAM (OIG-12-A-10)

REFERENCE: DIRECTOR, OFFICE OF NUCLEAR SECURITY AND 

INCIDENT RESPONSE, MEMORANDUM DATED 

JANUARY 27, 2015

Attached is the Office of the Inspector General’s (OIG) analysis and status of the 

recommendations as discussed in the agency’s response dated January 27, 

2015.Based on this response, recommendations 1, 2, and 3 remain in resolved status. 

Recommendations 4 and 5 were closed previously. Please provide an updated status

of the resolved recommendations by October 30, 2015.

If you have any questions or concerns, please call me at 415-5915 or Beth Serepca, 

Team Leader, at 415-5911.

Attachment: As stated

cc: M. Galloway, OEDO

C. Santos, OEDO

J. Arildsen, OEDO

J. Wiggins, NSIR

EDO_ACS Distribution
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 1: Develop and maintain a centralized database of security 

findings data to be used for evaluating licensee performance 

trends, and communicating this information to NRC staff, 

industry, and appropriate public stakeholders.

Agency Response

Dated January 27, 2015: To ensure an adequate database is constructed, the Office 

of Nuclear Security and Incident Response (NSIR) continues 

to evaluate the type of data to be collected and the method 

for sorting the data. This evaluation includes the extensive 

polling and consideration of end-user insights to ensure the 

staff appropriately establishes a database that provides a 

systematic analysis to assess trends across NRC regions 

and licensee fleets. NSIR has determined it would be 

prudent to combine its efforts with the Reactor Project 

System (RPS) Replacement Team (a currently funded

project) to develop, establish, and maintain a centralized 

database of security findings.

NSIR has coordinated with the RPS Replacement Team 

regarding this database and the collection of the data points 

to be used for tracking and trending security inspection 

findings. Consistent with current practice, inspectors will be 

required to input their data directly into the RPS 

Replacement System. While the RPS Replacement Project 

continues to progress, NSIR is using the current RPS and 

local databases to track and trend the licensee performance 

trends.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation when 

OIG staff has reviewed documentation of NSIR’s data 

collection and analysis procedures, and has verified that the 

centralized security database functions as intended in 

accordance with Recommendation 1. 

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 2: Formalize and implement a process for maintaining current 

and accurate data within a centralized database.

Agency Response

Dated January 27, 2015: NSIR is developing an office procedure to ensure data from 

the security inspection reports will be included in a 

centralized database. NSIR expects to have an initial 

procedure in place for tracking and assessing security 

findings in calendar year (CY) 2015. This procedure will be 

updated following the establishment of the recommended 

database(s).

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff has reviewed NSIR’s new office procedure for 

maintaining current and accurate security findings data in a 

centralized database and has verified implementation of this 

new guidance. 

Status: Resolved.
Audit Report

AUDIT OF NRC’S MANAGEMENT OF THE BASELINE SECURITY

INSPECTION PROGRAM

OIG-12-A-10

Status of Recommendations

Recommendation 3: Formalize and implement a process for ensuring Safeguards 

Information (SGI) findings data is current and accessible for 

use in trending security findings issues.

Agency Response

Dated January 27, 2015: The Replacement RPS (RRPS) under development does not 

currently include the capability to protect and store SGI 

inspection data. However, in addition to continued 

evaluation of the viability of integrating SGI inspection data 

into a single RRPS, NSIR staff engaged the staff of the 

Office of Information Security (OIS), regarding the 

Safeguards Local Area Network and Electronic Safe (SLES) 

to discuss the feasibility of developing an alternate 

centralized database similar to RPS within the existing SLES 

framework. The OIS staff is currently conducting a cost 

analysis regarding the development of this database within 

SLES and will deliver a cost estimate to NSIR staff during 

the first quarter of CY 2015. Once a cost estimate has been 

provided, NSIR staff will work with the Office of Nuclear 

Reactor Regulation and the Information Technology Board to 

assess the most cost effective method and obtain 

prioritization for a solution. As discussed in the “status” of 

actions with respect to Recommendation 2, NSIR is in the 

process of developing an office procedure to ensure that 

both non-SGI and SGI findings are categorized and put into 

centralized databases consistent with the sensitivity 

designation of the information.

OIG Analysis: The proposed corrective action addresses the intent of OIG’s 

recommendation. OIG will close this recommendation after 

OIG staff has verified that the NSIR office procedure 

referenced under Recommendation 2 contains instructions 

specific to SGI findings data and has confirmed 

implementation of this new office procedure in accordance 

with Recommendation 2.

Status: Resolved.