ENCLOSURE 

SUMMARY OF NRC ACTIONS

RESPONSE TO GAO REPORTS

1. Information Security: Federal Agencies Have Taken Steps to Secure Wireless 

Networks, but Further Actions Can Mitigate Risk (GAO-11-42SU) .............................. 2 

2. Nuclear Regulation: Nuclear Regulatory Commission's Oversight of Nuclear Power 

Reactors' Decommissioning Funds Could Be Further Strengthened (GAO-12-258) ......... 3 

3. Nuclear Regulatory Commission: Natural Hazard Assessments Could Be More RiskInformed (GAO-12-465) ..................................................................................... 5 

4. Spent Nuclear Fuel: Accumulating Quantities at Commercial Reactors Present 

Storage and Other Challenges (GAO-12-797) ......................................................... 7 

5. Nuclear Nonproliferation: Additional Actions Needed to Improve Security of 

Radiological Sources at U.S. Medical Facilities (GAO-12-925) ................................... 8 

6. Nuclear Power: Analysis of Regional Differences and Improved Access to Information 

Could Strengthen NRC Oversight (GAO-13-743) .................................................... 9 

7. Information Technology: Additional OMB and Agency Actions Are Needed to Achieve 

Portfolio Savings (GAO-14-65) ............................................................................11 

8. Nuclear Safety: Countries' Regulatory Bodies Have Made Changes in Response to 

the Fukushima Daiichi Accident (GAO-14-109) ......................................................13 

9. Nuclear Nonproliferation: Additional Actions Needed to Increase the Security of U.S. 

Industrial Radiological Sources (GAO-14-293) .......................................................14 

10. Uranium Contamination: Overall Scope, Time Frame, and Cost Information Is Needed 

for Contamination Cleanup on the Navajo Reservation (GAO-14-323) ........................17 

11. Federal Software Licenses: Better Management Needed to Achieve Significant 

Savings Government-Wide (GAO-14-413) ............................................................18 
2 

GAO Report – Information Security: Federal Agencies Have Taken Steps to 

Secure Wireless Networks, but Further Actions Can Mitigate Risk 

November 2010 

(GAO-11-42SU) 

The U.S. Government Accountability Office (GAO) in its report, “Information Security: Federal 

Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk,” 

made three recommendations to the U.S. Nuclear Regulatory Commission (NRC) to improve the 

security controls with regard to agency use of wireless networks. In response, on January 26, 

2011, the Chairman of the NRC informed Congress about the actions planned in response to the 

GAO recommendations. The status of the recommendation that remained open as of the NRC’s 

last report is provided below. 

Recommendation 2

Finalize and implement a written policy for configuring mobile devices when taken on international 

travel or to other potentially risky locations and for applying preventative measures to devices when 

they are returned. 

Status: 

The NRC provided high-level requirements for mobile devices taken on international travel in CSOSTD-0020, “Organization Defined Values for System Security Controls,” associated with NIST SP800-53 controls. NRC continues to develop international travel guidance for NRC staff travelling to 

other countries and standards for NRC electronic devices taken on such travel. NRC will develop 

and implement standards for a secure drop box capability that can be used by both international 

and domestic travelers and remote workers. 

This GAO recommendation remains open. 
3 

GAO Report – GAO Report - Nuclear Regulation: Nuclear Regulatory 

Commission's Oversight of Nuclear Power Reactors' Decommissioning 

Funds Could Be Further Strengthened 

May 2012 

(GAO-12-258) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Regulatory Commission's 

Oversight of Nuclear Power Reactors' Decommissioning Funds Could Be Further Strengthened,” 

provided five recommendations to the U.S. Nuclear Regulatory Commission (NRC) regarding 

decommissioning funding oversight. The status of the recommendations that remained open as of 

the NRC’s last report is provided below. 

Recommendation 3

Better ensure that licensees are providing reasonable assurance that they will have the necessary 

funds and improve the consistency of information the agency collects by documenting procedures 

describing the steps the staff should take in their reviews analyzing licensee documentation and 

verifying that the amount licensees report to NRC in decommissioning Funding Status reports 

match the amount on their year-end bank statements. 

Status: 

On January 16, 2015, NRC’s Office of Nuclear Reactor Regulation issued Revision 5 to its Office 

Instruction LIC-205, “Procedures for NRC’s Independent Analysis of Decommissioning Funding 

Assurance for Operating Nuclear Power Reactors,” which provides guidance for how NRC staff 

performs and documents its independent analysis of each operating power reactor licensee’s 

decommissioning funding status (DFS) report. This analysis formulates the basis for the staff’s 

finding of reasonable assurance that the licensee has sufficient funding available for radiological 

decommissioning at the time permanent termination of operations is expected. LIC-205, Revision 

5, incorporates enhancements to the staff’s review process of DFS reports (e.g., cash flow analysis) 

and lessons-learned from previous DFS reviews performed between 2011 and 2013. LIC-205 is 

publicly available and can be found at Agencywide Document Access and Management System 

(ADAMS) Accession No. ML14281A764. 

Although NRC does not require licensees to provide their year-end bank statements, the NRC staff 

implemented a Decommissioning Trust Fund Spot-Check program in 2008 pursuant to Commission 

direction in Staff Requirements Memorandum (SRM) to SECY-07-0197 (ADAMS Accession No. 

ML080100239). Through this program, NRC staff verified that reported amounts of accumulated 

decommissioning funds matched corresponding original trust fund statements. Since 2008, NRC 

staff performed spot-checks of nearly all power reactor licensees and found no significant 

inconsistencies in fund balances. Consequently, the staff has recommended to the Commission in 

SECY-15-0005, “Recommendation to Sunset the Decommissioning Trust Fund Spot-Check 

Program,” that the spot-check program be discontinued due to the lack of any significant findings of 

licensee misreporting. 

The NRC considers this GAO recommendation to be closed. 
4 

Recommendation 5

Consider reviewing a sample of the licensees’ investments to determine if licensees are complying 

with decommissioning investment standards and determine whether action should be taken to 

enforce these standards. 

Status: 

NRC staff documented its review of the 2013 DFS reports in SECY-13-0105, “Summary Findings 

Resulting from the Staff Review of the 2013 Decommissioning Funding Status Reports for 

Operating Power Reactor Licensees.” Following the review, NRC staff initiated an evaluation to 

determine whether additional information is needed to better understand the current methods used 

by licensees, investment managers, and trustees to assure compliance with the NRC’s regulations. 

Based on this analysis, NRC staff has developed SECY-15-0022, “Consideration of GAO 

Recommendation to Review Samples of Licensees’ Decommissioning Trust Funds for Compliance 

with Investment Fund Rules” (ADAMS Accession No. ML14310A458), which explains that Federal 

banking regulatory agencies examine trust departments every two to three years and at the 

trustee’s adherence to the investment restrictions and applicable laws are within the scope of those 

examinations. Therefore, the staff does not intend to change the NRC’s process for overseeing 

investment restrictions. 

The NRC considers this GAO recommendation to be closed. 

 
5 

GAO Report – Nuclear Regulatory Commission: Natural Hazard 

Assessments Could Be More Risk-Informed 

April 2012 

(GAO-12-465) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Regulatory Commission: 

Hazard Assessments Could Be More Risk-Informed,” made a recommendation to the U.S. Nuclear 

Regulatory Commission (NRC) to analyze whether licensees of operating reactors should be 

required to develop Probabilistic Risk Assessments (PRAs) that address natural hazards. In 

response, on July 30, 2012, the NRC Chairman informed Congress about the actions directly 

related to this issue. The status of the recommendation that remained open as of the NRC’s last 

report is provided below. 

Recommendation

Analyze whether licensees of operating reactors should be required to develop PRAs that address 

natural hazards. 

Status: 

The NRC’s Office of Nuclear Regulatory Research is conducting a Level 3 PRA for Vogtle Electric 

Generating Plant, Units 1 and 2. This Level 3 PRA effort encompasses natural hazards typically 

considered in previous external event PRAs (e.g., seismic events, tornadoes, hurricanes, and 

external flooding), and addresses the impact of these natural hazards on one or both operating 

reactors at the site, as well as on spent fuel stored on site (in either pools or dry casks). This study 

may identify accident prevention, accident mitigation, and emergency planning improvements for 

the reactors, the spent fuel pools, and dry cask storage in response to natural hazards or other 

causes. This Level 3 PRA project and its potential uses are discussed in SECY-12-0123, “Update 

on Staff Plans to Apply the Full-Scope Site Level 3 PRA Project Results to the NRC’s Regulatory 

Framework,” dated September 13, 2012. 

In 2011, former NRC Commissioner George Apostolakis led a risk management task force to 

develop a strategic vision and options for adopting a more comprehensive, holistic, risk-informed, 

performance-based regulatory approach for nuclear reactors, as well as for materials, waste, the 

fuel cycle, and transportation. This task force produced a report, NUREG-2150, “A Proposed Risk 

Management Regulatory Framework,” (RMRF) that provides recommendations on whether the 

NRC should make modifications to the regulatory framework. An interoffice working group was 

created to identify options and make recommendations, including the potential development of a 

Commission policy statement. The inter-office working group is currently developing a White Paper 

discussing options and alternatives for responding to NUREG-2150. In the coming months, the 

NRC plans to solicit stakeholder feedback on the White Paper and further develop the options for 

implementing a risk management framework, which will include an option that would require the 

licensees to develop PRAs that include natural hazards, as appropriate. 

Although the NRC does not currently require PRAs for operating reactors, all licensees have 

developed internal event PRA models and, in many cases, external event models. For example, to 

support risk-informed licensing actions, such as 10 CFR 50.48(c), many licensees have developed 

PRAs for fires—which are considered an external event. In addition, based on NRC’s review of the 

seismic hazard reevaluations performed to date, a number of licensees will likely perform seismic 

PRAs. In addition, the NRC has taken steps to advance the state of knowledge with regard to 

flooding risk assessments. In response to Commission direction, the NRC staff developed a multi-
6 

year flood hazard assessment research plan (ADAMS Accession No. ML14296A442) that will help 

in the development of flooding PRAs in the future. 

This GAO recommendation remains open. 

 
7 

GAO Report – Spent Nuclear Fuel: Accumulating Quantities at 

Commercial Reactors Present Storage and Other Challenges 

August 2012 

(GAO-12-797) 

The U.S. Government Accountability Office (GAO), in its report, “Spent Nuclear Fuel: Accumulating 

Quantities at Commercial Reactors Present Storage and Other Challenges,” recommended that the 

U.S. Nuclear Regulatory Commission (NRC) develop a mechanism for identifying and accessing all 

classified studies to help facilitate decisions on storing and disposing of spent nuclear fuel over the 

coming decades. The status of the recommendation that remained open as of the NRC’s last 

report is provided below. 

Recommendation

To help facilitate decisions on storing and disposing of spent nuclear fuel over the coming decades, 

the Chairman of the NRC should direct agency staff to develop a mechanism that allows individuals 

with appropriate clearances and the need to know to easily identify and access classified studies so 

as to help ensure that institutional knowledge is not lost. 

Status: 

The NRC staff committed to developing and implementing a pilot program database to include nonclassified information detailing key attributes of a document to identify location and points of 

contacts. The pilot program was completed in 2013, and the NRC staff completed a second, 

expanded pilot program in December 2014. The scope of the expanded pilot program extended 

beyond spent nuclear fuel studies and included a representative sampling of all classified 

documents and media received and produced by the NRC. To address concerns regarding 

classification by compilation, during the course of the second pilot program, the participants 

developed a localized catalog of the classified documents and media in their possession and 

tracked the level of effort associated with completing this task. The staff is currently compiling the 

data gathered from the second pilot program and documenting lessons learned regarding classified 

records management at the NRC. The NRC staff will evaluate the options based on resource 

burden, security risk, and usability in order to formulate a recommendation for the Commission on a 

preferred path forward. In spring 2015, the NRC staff will deliver an Options Paper to the 

Commission to provide a comprehensive review of the second pilot program, as well as options for 

maintaining accountability of all classified documents and media received and produced by the 

NRC in the future. 

This GAO recommendation remains open. 
8 

GAO Report – Nuclear Nonproliferation: Additional Actions Needed to 

Improve Security of Radiological Sources at U.S. Medical Facilities 

September 2012 

(GAO-12-925) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Nonproliferation: 

Additional Actions Needed to Improve Security of Radiological Sources at U.S. Medical Facilities,” 

made four recommendations to the U.S. Nuclear Regulatory Commission (NRC) and the U.S. 

Department of Energy (DOE) regarding security at NRC and Agreement-State-licensed medical 

facilities. The status of the recommendation that remained open as of the NRC’s last report is 

provided below. 

Recommendation 4

The GAO recommends that the Chairman of the NRC supplement existing guidance for facility 

officials, including Radiation Safety Officers, who may be responsible for implementing the NRC’s 

security controls, in how to adequately secure equipment containing high-risk radiological sources 

and conduct trustworthiness and reliability determinations. 

Status: 

The NRC has provided and will continue to provide, guidance to licensees on how to comply with 

regulatory requirements. In November 2012, a Title 10 of the Code of Federal Regulations (10 

CFR) Part 37 Implementation Working Group, including representatives from across NRC and the 

Organization of Agreement States, was formed. This group developed a security “best practice” 

guidance document, NUREG-2166, “Physical Security Best Practices for the Protection of RiskSignificant Radioactive Material,” which was published May 2014. NUREG-2166 provides guidance 

with specific emphasis on security best practices and effective application of security technology 

that licensees may consider in developing their security programs, and it is available at 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr2166/. This document is in addition to 

the implementing guidance document developed to accompany the final rule, 10 CFR Part 37, 

“Physical Protection of Byproduct Material.” 

The NRC considers this GAO recommendation to be closed. 
9 

GAO Report – Nuclear Power: Analysis of Regional Differences and 

Improved Access to Information Could Strengthen NRC Oversight 

September 2013 

(GAO-13-743) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Power: Analysis of 

Regional Differences and Improved Access to Information Could Strengthen NRC Oversight,” made 

three recommendations to the U.S. Nuclear Regulatory Commission (NRC). In response, on 

December 16, 2013, the Chairman of the NRC informed Congress about the planned response to 

the recommendations identified by GAO. The status of the recommendations that remained open 

as of the NRC’s last report is provided below. 

Recommendation 1

To better meet its goal of implementing objective and consistent oversight, the NRC Commissioners 

direct agency managers to conduct a comprehensive analysis of the causes of the differences in 

the identification and resolution of findings. 

Status: 

The NRC completed a comprehensive analysis of the causes of the differences in the identification 

and resolution of findings and documented this analysis in a report entitled, “Analysis of the Causes 

of Regional Differences in the Number of Inspection Findings of Very Low Significance (Green) and 

Non-Escalated Violations,” dated December 2014 (ADAMS Accession No. ML14252A049). The 

staff is assessing potential program changes in response to the results of this analysis. 

The NRC considers this GAO recommendation to be closed. 

Recommendation 2

To improve transparency and better enable the public, Congress, and others to independently track 

findings, all documents related to the findings, and the finding’s resolution, the NRC Commissioners 

direct the agency to either modify NRC’s publicly available recordkeeping system to do so or 

develop a publicly accessible tool that does so. 

Status: 

The NRC’s official recordkeeping system is the Agencywide Documents Access and Management 

System (ADAMS). All retained NRC documents, including inspection findings and their resolution, 

are stored in ADAMS and made publicly available, with the exception of sensitive, classified, or 

protected information. As part of the Reactor Oversight Process (ROP) enhancement project 

initiated at the direction of the Commission in 2012, the NRC developed a communications strategy 

focused on improving the openness and transparency of the ROP. Two major components of this 

strategy include the re-design and organization of the NRC external and internal websites, placing 

emphasis on the use of plain language versus technical jargon, and the accessibility of NRC 

documents and related findings to end-users. Additionally, the communications strategy includes 

enhancements to provide a publicly available option (“Contact Us” form) as an additional method for 

stakeholders to ask questions and receive answers regarding the ROP. The NRC will continue to 

identify ways to improve ROP transparency and effectively and efficiently track documents related 

to inspection findings through enhanced tools to facilitate public access to inspection information. 
10 

The NRC considers this GAO recommendation to be closed. 

Recommendation 3

To help NRC staff more efficiently use past experiences in its oversight activities, the NRC 

Commissioners direct agency officials to evaluate the challenges inspectors face in retrieving all 

relevant information on plant performance and previous oversight activities, and improve its 

systems accordingly to address these challenges. 

Status: 

The NRC will make plant performance and oversight information more readily searchable and 

available to NRC inspection staff and other appropriate NRC personnel. As an example, the NRC 

is working to upgrade the Reactor Program Systems software and improve staff access to operating 

experience. The NRC plans to integrate these changes with an update to the internal Resident 

Inspector webpage. In addition, the NRC is evaluating methods for soliciting anonymous 

feedback/comments on administrative and support concerns relevant to Resident Inspectors. 

This GAO recommendation remains open. 

 
11 

GAO Report – Information Technology: Additional OMB and 

Agency Actions Are Needed to Achieve Portfolio Savings 

November 2013 

(GAO-14-65) 

The U.S. Government Accountability Office (GAO), in its report, “Information Technology: 

Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings,” reviewed the Office 

of Management and Budget’s (OMB) policy, requirements, and implementation of the 2012 

PortfolioStat initiative, a process whereby 26 Federal agencies, including the U.S. Nuclear 

Regulatory Commission (NRC), gather information on their information technology investments, and 

develop plans for consolidation and increased use of shared service delivery models. To improve 

the NRC’s implementation of PortfolioStat, GAO made two recommendations. The status of the 

actions taken by the NRC in response to the GAO recommendations is provided below. 

Recommendation 1 

Develop a complete commodity information technology (IT) Baseline. 

Status: 

 

The NRC continues to make progress in centralizing its IT commodity spending under one 

contract. The NRC is also transitioning to a new IT investment classification methodology to better 

capture and classify IT costs, including commodity IT costs. The NRC is reviewing all multiple IT 

support contracts to determine if costs are captured in specific alignment with the OMB category 

definitions. NRC plans to reach out to other comparable agencies to solicit best practices. With 

this level of visibility, the NRC will be able to further identify effective commodity IT contract 

consolidation opportunities. The NRC is also preparing for re-competing its IT services contract 

(ITISS) to maximize the value and quality of its enterprise-wide services and to incorporate “cloud” 

alternatives. 

This GAO recommendation remains open. 

Recommendation 2

In future reporting to OMB, fully describe the following PortfolioStat action plan elements: (1) 

consolidate commodity IT spending under the agency Chief Information Officer (CIO); (2) establish 

targets for commodity IT spending reductions and deadlines for meeting those targets; (3) target 

duplicative systems or contracts that support common business functions for consolidation; and (4) 

establish a process to identify these potential investments and a schedule for eliminating them from 

the portfolio. 

Status: 

NRC leverages the annual OMB PortfolioStat process and the agency’s IT planning and budget 

formulation process to identify investments for streamlining and consolidation. The IT planning and 

budget formulation process is under the agency’s IT governance board authority, co-chaired by the 

CIO and the Chief Financial Officer (CFO). As an outcome of the August 2014 OMB-NRC 

PortfolioStat session, OMB and NRC agreed in October 2014 to a number of actions that will 

optimize use of commodity IT investments. Progress towards these actions is reported quarterly by 

NRC to OMB E-gov through the OMB Integrated Data Collection (IDC) tool. Specific to the GAO 

Recommendation 2, NRC has made progress in each of the 4 areas below: 
12 

(1) Consolidate commodity IT spending under the agency CIO: The NRC CIO is a co-chair of 

the agency IT governance board and has decision authority on the agency IT investments 

including commodity IT. OMB is aware of the NRC CIO authority and does not require 

further actions based on results from the PortfolioStat reviews. 

(2) Establish targets for commodity IT spending reductions and deadlines for meeting those 

targets: Through the FY 2014 PortfolioStat process, NRC and OMB agreed to establish a 

schedule to consolidate the NRC data centers and report on a quarterly basis to OMB 

progress and metrics towards consolidation of this commodity IT investment. NRC agreed 

to accelerate the data center consolidation schedule. NRC will continue to provide progress 

reports for these actions through the OMB quarterly IDC process. 

(3) Target duplicative systems or contracts that support common business functions for 

consolidation: The NRC IT planning and budget formulation process will continue to 

indicate opportunities to identify common business functions for consolidation and eliminate 

duplicative systems and contracts. NRC will continue to provide updates on these efforts to 

OMB through the OMB Exhibit 300 and 53 reporting process. 

(4) Establish a process to identify these potential investments and a schedule for eliminating 

them from the portfolio: NRC continues to leverage the annual IT planning and budget 

formulation process to identify opportunities to streamline and consolidate the agency’s IT 

investments. The agency IT governance boards play a key role in the process by providing 

IT investment priorities and recommendations. The CIO and the CFO, who are co-chairs of 

the IT governance board, have authority over the agency’s IT investment decisions. As new 

opportunities are identified, NRC will make the information available to OMB through the 

OMB Exhibit 300 and 53 reporting process. 

The NRC considers this GAO recommendation to be closed. 
13 

GAO Report – Nuclear Safety: Countries' Regulatory Bodies Have Made 

Changes in Response to the Fukushima Daiichi Accident 

March 2014 

(GAO-14-109) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Safety: Countries' 

Regulatory Bodies Have Made Changes in Response to the Fukushima Daiichi Accident,” assessed 

the international regulatory response since the Daiichi accident. GAO examined (1) the actions 

nuclear regulatory bodies from selected countries have taken to strengthen nuclear safety; (2) the 

extent to which these countries have established automated systems to collect and transmit 

accident data; and (3) steps international organizations have taken to support nuclear regulatory 

bodies and promote nuclear safety worldwide since the accident. GAO provided the U.S. Nuclear 

Regulatory Commission (NRC) two recommendations to encourage International Atomic Energy 

Agency (IAEA) to track the status of recommendations from peer reviews and to consider 

expediting its decision on whether or how to upgrade its automated system for transmitting key 

reactor data systems. The NRC addressed these recommendations in its initial response to 

Congress dated, May 12, 2014. The status of the recommendation that remained open as of the 

NRC’s initial response is provided below. 

Recommendation 1

The GAO recommended that the Secretary of State, in coordination with the NRC Chairman, work 

with and encourage officials from the IAEA to systematically track the status of the 

recommendations made by IAEA peer review missions and make this information publicly available 

to the extent feasible. 

Status: 

The NRC has consulted on this recommendation with the Department of State (DOS) which would 

have the lead in discussions with the IAEA. The NRC has and will continue to work with DOS to 

discuss the feasibility of the GAO recommendation with IAEA and its Member States. 

The NRC considers this GAO recommendation to be closed. 

 
14 

GAO Report – Nuclear Nonproliferation: Additional Actions Needed to 

Increase the Security of U.S. Industrial Radiological Sources 

June 2014 

(GAO-14-293) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Nonproliferation: 

Additional Actions Needed to Increase the Security of U.S. Industrial Radiological Sources,” made 

three recommendations to the U.S. Nuclear Regulatory Commission (NRC) and one 

recommendation to the NRC, the U.S. Department of Energy (DOE), and the U.S. Department of 

Homeland Security (DHS) regarding security at NRC and Agreement-State-licensed facilities using 

high-risk industrial radiological sources. The status of the actions taken by the NRC in response to 

the GAO recommendations is provided below. 

Recommendation 1

To ensure that the security of radiological sources at industrial facilities is reasonably assured, the 

Chairman of the NRC should obtain the views of key stakeholders, such as licensees, during the 

development of the Best Practices Guide to ensure that the guide contains the most relevant and 

useful information on securing the highest risk radiological sources. 

Status: 

The NRC agreed with the GAO’s recommendation that the views of key stakeholders, such as 

licensees, should be included in the guidance document, “Physical Security Best Practices for the 

Protection of Risk Significant Radioactive Material” (i.e., the Best Practices Guide). Published in 

May 2014, the Best Practices Guide focuses on areas of concern that licensees indicated to 

inspectors during the inspection process. The NRC is assessing the effectiveness of this guidance 

document during the first one to two years following the implementation of 10 CFR Part 37 to 

determine if any revisions to this document are needed and will make revisions accordingly using 

NRC’s public participation process. 

The NRC considers this GAO recommendation to be closed. 

Recommendation 2

To ensure that the security of radiological sources at industrial facilities is reasonably assured, the 

Chairman of the NRC should reconsider whether the definition of collocation should be revised for 

well logging facilities that routinely keep radiological sources in a single storage area but secured in 

separate storage containers. 

Status: 

The NRC acknowledges the GAO’s recommendation that the definition of collocation should be 

reevaluated for well logging facilities that routinely keep radiological sources in a single storage 

area but secured in separate containers. Inspection of collocated sources indicates that 

appropriate security is being maintained. NRC is conducting a post-implementation review of the 

effectiveness of the 10 CFR Part 37 requirements to determine whether any additional security 

measures, guidance documents (including revising NUREG-2155, “Implementation Guidance for 10 

CFR Part 37, ‘Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material’” 

and the Best Practices Guide), rulemaking changes or licensee outreach efforts are appropriate. 

The reevaluation of the definition of collocation is included in this effort. 
15 

This GAO recommendation remains open. 

Recommendation 3

To ensure that the security of radiological sources at industrial facilities is reasonably assured, the 

Chairman of the NRC should conduct an assessment of the trustworthiness and reliability (T&R) 

process--by which licensees approve employees for unescorted access--to determine if it provides 

reasonable assurance against insider threats, including (1) determining why criminal history 

information concerning convictions for terroristic threats was not provided to a licensee during the 

T&R process to establish if this represents an isolated case or a systemic weakness in the T&R 

process; and (2) revising, to the extent permitted by law, the T&R process to provide specific 

guidance to licensees on how to review an employee's background. NRC should also consider 

whether certain criminal convictions or other indicators should disqualify an employee from T&R or 

trigger a greater role for NRC. 

Status: 

The NRC acknowledges the GAO’s recommended assessment of the T&R process to determine if 

it provides reasonable assurance against an insider threat. The current T&R requirements are in 

place to ensure that individuals who have unescorted access to category 1 and category 2 

quantities of radioactive material are trustworthy and reliable and do not constitute an unreasonable 

risk to the public health and safety or security of the radioactive material. Licensees are required to 

evaluate all available information in making a T&R determination for unescorted access to 

radioactive materials, including the criminal history records information pertaining to the individual. 

The NRC requires licensees to conduct a Federal Bureau of Investigation identification and criminal 

history records check to determine if an individual has a record of criminal activity that indicates that 

the individual should not have unescorted access to radioactive materials. As previously indicated, 

the NRC published the Best Practices Guide in May 2014, which provides additional guidance to 

licensees in conducting and evaluating T&R determinations. Nonetheless, the NRC is conducting a 

review of the effectiveness of the T&R requirements in 10 CFR Part 37, over the next year or two to 

determine whether any additional security measures, guidance documents, rulemaking changes or 

licensee outreach efforts are appropriate. 

This GAO recommendation remains open. 

Recommendation 4

To better leverage resources, including expertise, to address vulnerabilities associated with 

radiological sources while in transit, the Administrator of National Nuclear Security Administration 

(NNSA), the Chairman of NRC, and the Secretary of DHS should review their existing collaboration 

mechanism for opportunities to enhance collaboration, especially in the development and 

implementation of new technologies. 

Status: 

NRC agrees with this recommendation and continues to conduct periodic meetings with senior 

management of these agencies to enhance coordination and collaboration on overarching technical 

and policy issues related to source security. The NRC routinely collaborates with these agencies 

on a range of topics including the security of radiation sources. Both the NNSA and the DHS 

participate along with other agencies and State representatives on the Radiation Source Protection 

and Security Task Force, which is chaired by the Chairman of the NRC, consistent with the Energy 
16 

Policy Act of 2005. NRC also collaborates with DHS and DOE on several DHS initiatives regarding 

radiological materials, including the Global Nuclear Detection Architecture and the interagency 

Government Coordinating Council meeting to address nuclear and radiological security issues. 

The NRC considers this GAO recommendation to be closed.

 
17 

GAO Report - Uranium Contamination: Overall Scope, Time Frame, and Cost 

Information Is Needed for Contamination Cleanup on the Navajo Reservation 

May 2014 

(GAO-14-323) 

The U.S. Government Accountability Office (GAO), in its report, “Uranium Contamination: Overall 

Scope, Time Frame, and Cost Information Is Needed for Contamination Cleanup on the Navajo 

Reservation,” made one recommendation to Federal agencies regarding incorporation of key 

practices into the development of a coordinated outreach strategy for the next Five-Year Plan. The 

status of the actions taken by the U.S. Nuclear Regulatory Commission (NRC) in response to the 

GAO recommendation is provided below. 

Recommendation

To ensure that agencies working on the 2014 Five-Year plan better align their activities and 

resources, GAO recommends that the Administrator of Environmental Protection Agency (EPA); the 

Secretaries of Energy, the Interior, and Health and Human Services; and the Chairman of the NRC, 

as they develop a coordinated outreach strategy to include in the 2014 Five-Year plan, take action 

to incorporate key practices in their collaborative effort, such as defining and agreeing on the 

agencies’ respective roles and responsibilities. 

Status: 

The NRC has continued to work with the other Federal agencies and the Navajo Nation on 

implementing the objectives of the 2014 Five-Year Plan. NRC staff participated in a teleconference 

with the Navajo Nation and other Federal agencies on December 3, 2014, to begin to implement the 

2014 Five-Year Plan, including the development of the Community Outreach Network. During the 

teleconference, the agencies discussed the staffing, organization, and funding for the Community 

Outreach Coordinator position. The agencies agreed on the roles that each agency will have in the 

funding of the Community Outreach Coordinator position and how the agencies will contribute to the 

development of the Community Outreach Coordinator. In addition, the NRC is piloting a Tribal 

training program of 2-day seminars. A training session was held at the Navajo Dine College on 

January 13-14, 2015, on radioactivity, health physics, byproduct material, the National 

Environmental Policy Act, and NRC’s regulatory activities that protect public health and safety. 

EPA and DOE collaborated with NRC in outreach for this training seminar by disseminating 

invitations to their Tribal contacts. EPA and DOE staffs also attended the training seminar and 

offered feedback to NRC to improve future training seminars. 

The NRC considers this GAO recommendation to be closed. 

 
18 

GAO Report – Federal Software Licenses: Better Management Needed 

to Achieve Significant Savings Government-Wide 

May 2014 

(GAO-14-413) 

The U.S. Government Accountability Office (GAO), in its report, “Federal Software Licenses: Better 

Management Needed to Achieve Significant Savings Government-Wide,” made recommendations 

to many government entities, including the U.S. Nuclear Regulatory Commission (NRC) to ensure 

the effective management of software licenses. The status of the actions taken by the NRC in 

response to the GAO recommendations is provided below, 

Recommendation 1

Develop an agencywide comprehensive policy for the management of software licenses that 

address the weaknesses identified by GAO. 

Status: 

The NRC reviewed the governance, processes, and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 

current state and future state requirements. A comprehensive policy for the management of 

software licenses will be developed by the end of FY 2015. 

This GAO recommendation remains open. 

Recommendation 2

Employ a centralized software license management approach that is coordinated and integrated 

with key personnel for the majority of agency software license spending and/or enterprise-wide 

licenses. 

Status: 

The NRC reviewed the governance, processes and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 

current state and future state requirements. As part of this assessment, process maps were 

developed to identify the roles and responsibilities of each key stakeholder for key high-level 

processes for software management. The NRC will continue to further define core processes as 

they relate to software asset management. 

This GAO recommendation remains open. 

 

Recommendation 3

Establish a comprehensive inventory of software licenses using automated tools for the majority of 

agency software license spending and/or enterprise-wise licenses. 

Status: 

The NRC reviewed the governance, processes, and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 
19 

current state and future state requirements. As part of this assessment, the requirements for 

automated tools were identified. The NRC plans to procure a software asset management tool by 

the end of FY 2015. 

This GAO recommendation remains open. 

Recommendation 4

Regularly track and maintain a comprehensive inventory of software licenses using automated tools 

and metrics. 

Status: 

The NRC reviewed the governance, processes, and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 

current state and future state requirements. As part of this assessment, the requirements for 

automated tools were identified. The NRC plans to procure a software asset management tool by 

the end of FY 2015. Once the tool is deployed, the NRC will regularly track and maintain a 

comprehensive inventory of software licenses. 

This GAO recommendation remains open. 

Recommendation 5

Analyze agencywide software license data, such as costs, benefits, usage, and trending data, to 

identify opportunities to reduce costs and better inform investment decision making. 

Status: 

The NRC reviewed the governance, processes, and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 

current state and future state requirements. As part of this assessment, the requirements for 

automated tools were identified. The NRC plans to procure a software asset management tool by 

the end of FY 2015. Once the tool is deployed, the NRC will regularly analyze software license 

data to identify opportunities to reduce costs and make better informed investment decisions. 

This GAO recommendation remains open. 

Recommendation 6

Provide software license management training to appropriate agency personnel addressing contract 

terms and conditions, negotiations, laws and regulations, acquisition, security planning, and 

configuration management. 

Status: 

The NRC reviewed the governance, processes, and technology relating to NRC’s management of 

software assets as part of a comprehensive assessment on NRC’s Software Asset Management’s 

current state and future state requirements. A comprehensive policy for the management of 

software licenses will be developed by the end of FY 2015. Once the policy is established, the 

NRC will provide appropriate training to agency personnel addressing contract terms and 
20 

conditions, negotiations, laws and regulations, acquisition, security planning, and configuration 

management. 

This GAO recommendation remains open.