Enclosure 

Response to Requests for Information 

Senator Dianne Feinstein 

Letter Dated August 22, 2016 

1. What actions does NRC intend to take to strengthen its radiological materials 

licensing program so that only those with legitimate needs can obtain these 

dangerous materials? 

The NRC took several immediate actions in October 2015 when the Government 

Accountability Office (GAO) notified the NRC of its investigation in which it set up shell 

companies and sought to acquire radioactive material licenses. The NRC issued letters 

to the 37 Agreement States regarding the importance of pre-licensing activities. 

Additionally, the NRC provided enhanced training for pre-licensing activities, which 

included conducting webinars with the NRC regions and Agreement States to ensure 

that processes and guidance for conducting pre-licensing visits are being properly 

implemented. 

The NRC also chartered two NRC/Agreement State working groups to evaluate 

vulnerabilities identified as a result of the 2015 GAO investigation, as well as possible 

mitigation strategies, specifically with respect to (1) enhancements to the current prelicensing guidance, and (2) processes for license verification and transfer of Category 3 

sources. The working groups are finalizing their recommendations, including actions to 

address all three GAO audit recommendations. Insights on specific enhancements 

being considered are provided in response to Questions 4 and 7. The working groups 

will report to the Commission on their recommendations in calendar year 2017. 

It is important to note that, as part of the Radiation Source Protection and Security Task 

Force (task force), the NRC, 13 of its Federal counterparts, and the Agreement States 

have continuously evaluated radioactive source security over the past 10 years, as 

required by the Energy Policy Act of 2005, and have not identified any significant 

regulatory gaps. Most recently, the task force reaffirmed the focus on higher-risk 

Category 1 and 2 sources in its August 2014 report, stating, "the global use of 

radioactive sources has remained stable both in species and quantity such that the 

addition of novel radionuclides or changes in thresholds for the existing list1 is not 

justified at this time.” The focus on Category 1 and 2 sources is also consistent with 

international safety and security conventions and guidance. The NRC has been 

deliberate in its application of enhanced security requirements to the most risk-significant 

radioactive materials, which has included implementing changes to pre-licensing 

practices, issuing security orders and, ultimately, adopting the regulations of Title 10 

Code of Federal Regulations (10 CFR) Part 37, “Physical Protection of Category 1 and 

Category 2 Quantities of Radioactive Material.” 

2. The NRC made improvements to its radiological materials licensing program since 

the 2007 GAO report. Yet, in 2016, the GAO was able to obtain commitments to 

acquire a significantly more dangerous quantity of a radiological material 

attractive for someone seeking to build a dirty bomb. How did this happen? 

 

1 The list can be found in the 2014 Radiation Source Protection and Security Task Force Report, August 14, 2014, 

Table 1-1, p. 6. http://www.nrc.gov/security/byproduct/2014-task-force-report.pdf. 
2 

After the 2007 GAO investigation, the NRC and Agreement States made significant 

improvements in strengthening their licensing and regulatory processes for radioactive 

material in quantities of concern (i.e., quantities of Category 1 and 2 material), including 

establishing requirements for the following: 

• background checks and fingerprinting for access to risk-significant radioactive 

material; 

• licensee control of personnel access to areas where radioactive material in 

quantities of concern is used and stored; 

• licensee establishment of documented security programs; 

• coordination and response planning between licensees and local law 

enforcement; 

• coordination and tracking of radioactive material shipments; 

• verification with the regulator that the receiver is authorized to possess the 

materials and quantities being transferred via the License Verification System 

(LVS); and 

• confirmation that the licensee/applicant is prepared to implement the security 

requirements of 10 CFR Part 37 before receiving radioactive material. 

The NRC and Agreement States also enhanced guidance for pre-licensing activities 

following GAO’s 2007 audit. This included developing and implementing internal “prelicensing” guidance checklists that were issued in September 2008 to the NRC regional 

offices and Agreement States. This pre-licensing guidance provides license reviewers 

and inspectors with criteria to: (1) establish a basis for confidence that the radioactive 

materials will be used as intended; (2) perform pre-licensing site visits for new applicants 

or new owners, who are unknown to the NRC or an Agreement State, in order to verify 

the legitimacy of the applicant; and (3) forward suspicious and/or ambiguous application 

information to the appropriate authorities for follow-up investigation. The NRC and the 

37 Agreement States also collaboratively review the licensing programs of each 

Agreement State and the NRC. This process is known as the Integrated Materials 

Performance Evaluation Program (IMPEP). The IMPEP evaluations include a review of 

the implementation of pre-licensing guidance. 

However, the most recent investigation conducted by GAO went well beyond the 2007 

investigation in its sophistication and planning, in that GAO applied for the licenses and 

rented storefront/warehouse space to demonstrate their legitimacy during pre-licensing 

visits. The GAO was also provided NRC’s non-public pre-licensing guidance as part of 

their previous audit activities. Despite this level of effort, GAO was unsuccessful in two 

of three instances. The Agreement State that issued the license conducted a selfassessment and root cause analysis and determined that the staff did not complete all 

the required steps in the Agreement State’s pre-licensing process, and also concluded 

that management oversight of the program was not effective. In addition, the NRC and 

Agreement States conducted self-assessments of their implementation of the prelicensing guidance and took corrective action when issues were identified. 

The GAO's success in obtaining a radioactive materials license revealed a single, 

isolated failure on the part of an individual among one of our 37 Agreement State 

partners to fully implement the pre-licensing guidance that was put in place in
3 

September 2008 following the GAO's 2007 investigation. When the pre-licensing 

process was followed by the other Agreement State and the NRC regional office, the 

GAO efforts to obtain a license were effectively prevented.

3. Does NRC have the resources it needs to sufficiently strengthen its licensing 

program so that fake businesses cannot obtain genuine licenses? If not, since 

NRC is largely funded from the fees it charges, does NRC need to increase license 

fees to conduct sufficient oversight of its radiological materials licensing 

program? 

Yes, the NRC has sufficient resources to evaluate GAO’s recommendations and to take 

appropriate action. 

4. The NRC continues to use paper licenses to authorize the purchase and 

possession of dangerous radioactive materials. As the GAO work showed, paper 

licenses can be easily altered or forged. What does NRC intend to do to address 

the weaknesses and limitations associated with the use of paper licenses? 

After carefully evaluating alternatives to paper licenses in 2008, the NRC working group 

assessing options to prevent counterfeiting of radioactive materials licenses determined, 

in its interim report, that completely transitioning away from all paper licenses was not 

practical and would be cost-prohibitive for the approximately 20,000 licenses held for 

radioactive material and overseen by the NRC and 37 Agreement States. 

Consistent with the findings of the task force mentioned in the response to Question #1, 

the NRC and Agreement States apply a graded approach to security of radioactive 

materials. For materials that are considered “risk-significant” (i.e., Category 1 and 2 

quantities of material), relying on a paper license for the function of performing license 

verification prior to the transfer of material between licensees is not permitted by NRC or 

the Agreement States. For Category 1 and 2 materials, the originating licensee sending 

the material has to verify with the regulator or with the LVS that the licensee receiving 

the radioactive material is authorized to do so. 

Through these controls, an altered license for Category 1 or 2 quantities would be 

quickly identified by the regulator, and the originating licensee would not be approved to 

transfer the radioactive material. Transfers of Category 1 and 2 materials account for 

about 11,000 transactions each year; there are about 10,000 transactions per year 

involving Category 3 sources. 

As part of its response to the most recent GAO audit, the NRC working group evaluating 

current processes for license verification and transfer of Category 3 sources is 

specifically reviewing continued use of paper licenses for Category 3 materials. This 

working group is considering alternatives such as the verification of transfers of Category 

3 material through the Web-based Licensing System (WBL), LVS, or direct contact with 

the regulatory agency that issued the license. These methods would not depend on 

paper licenses to verify the transfer of Category 3 materials. 

5. NRC has an ongoing peer-review inspection program designed to assure that NRC 

regional offices and agreement states are performing its radiological materials 
4 

licensing properly. This program is called the Integrated Materials Performance 

Evaluation Program (IMPEP). Given that this program did not identify the poor 

performance that led to the GAO shell company getting a genuine license, how 

does NRC plan to strengthen the IMPEP program? 

Since 2009, IMPEP teams evaluating the Agreement States and the NRC regional 

programs have reviewed the implementation of the 2008 pre-licensing guidance 

discussed in response to Question #2. Specifically, the teams evaluate pre-licensing 

guidance implementation through the assessment of inspection and licensing casework, 

interviews with radioactive materials program inspectors and licensing reviewers, and by 

performing accompaniments of inspectors on radioactive materials inspections. IMPEP 

reviews are retrospective audits of the effectiveness of programs and are conducted 

every 4 years. The IMPEP teams use a risk-informed sampling method when selecting 

the licensing and inspection casework. 

As the NRC considers the three GAO recommendations, any changes in the prelicensing guidance will be communicated to the Agreement States and the NRC regional 

offices. The IMPEP teams will evaluate adherence to the guidance as part of the IMPEP 

review process. Since the pre-licensing guidance was revised in 2008, all Agreement 

State and NRC regional programs have been evaluated for implementation of that 

guidance at least once via the IMPEP process. There are several examples since 2009 

where weaknesses with implementation of pre-licensing guidance were noted by IMPEP 

teams, requiring subsequent remedial action. 

In its 2013 annual report to the Commission on the Agreement State Program, the NRC 

staff identified weaknesses with implementation of the pre-licensing guidance for three of 

the nine programs reviewed in 2013 under the IMPEP process. The NRC staff 

subsequently issued a letter to all of the Agreement States indicating that the NRC 

considers the pre-licensing guidance an essential component of a licensing program 

given its importance in providing a basis of confidence that radioactive materials will be 

used as intended, ensuring that site visits are performed for “unknown” applicants, and 

forwarding suspicious applications to the appropriate authority for follow-up. 

An IMPEP review was conducted for the Agreement State that issued the license to the 

GAO’s fictitious company during February 2010 and February 2014. The IMPEP teams 

did not identify any weaknesses with the Agreement State’s implementation of the prelicensing guidance during these two reviews. However, the IMPEP review is unable to 

identify potential human errors which may occur regardless of the clarity in guidance. As 

noted in the response to Question #2, a root cause analysis of the Agreement State’s 

failure to prevent GAO’s efforts to obtain a license revealed that its staff did not complete 

all the required steps in the Agreement State’s pre-licensing process. In particular, staff 

from the Agreement State’s licensing group conducted the pre-licensing site visit of the 

GAO shell company whereas, as highlighted in the report following the February 2014 

IMPEP review, the Agreement State’s preferred process is to have qualified inspector 

from the Agreement State’s staff perform this site visit. 

The NRC will continue to use the IMPEP process to review implementation of the prelicensing guidance by the Agreement States and NRC regional offices. The NRC is 

currently revising the process for the conduct of IMPEP reviews to improve consistency, 
5 

and to incorporate a number of changes and enhancements identified through audits 

and self-assessments. This revision to the IMPEP process will incorporate any 

enhancements that result from the NRC’s evaluation of the GAO audit results. 

6. In 2013, NRC adopted an updated radiological source security regulation (10 CFR 

Part 37 - Physical Protection of Category 1 and Category 2 Quantities of 

Radioactive Material). Since that time, has NRC or any other entity performed a 

wholesale review of the effectiveness of this regulation? If not, how will NRC 

determine whether these regulations are actually protective of radioactive 

materials used in healthcare, industrial, and other applications? 

The NRC is finalizing a report to Congress on the effectiveness of 10 CFR Part 37. The 

report was prepared in response to the fiscal year 2015 Energy and Water 

Appropriations Act (hereinafter “Appropriations Act”), which directed NRC to evaluate the 

effectiveness of the requirements of 10 CFR Part 37, “Physical Protection of Category 1 

and Category 2 Quantities of Radioactive Material,” and determine whether such 

requirements are adequate to protect high-risk radiological material (i.e., Category 1 and 

2). The report is on schedule to be provided to Congress by the December 2016 

deadline. 

The Appropriations Act also required that, no later than 2 years after the completion of 

the NRC evaluation of 10 CFR Part 37, GAO must provide a report to Congress on the 

effectiveness of the requirements of 10 CFR Part 37 for NRC and Agreement State 

licensees and recommendations to further strengthen radiological security. The 

Appropriations Act directed that GAO’s audit include assistance from an independent 

group of security experts. 

In an effort to conduct a comprehensive evaluation of the rule and to address 

recommendations made by GAO in audits on the security of sources used in medical 

and industrial applications, the NRC staff performed a multifaceted evaluation of the rule 

and associated guidance documents, as well as licensee implementation. This 

evaluation encompassed a total of nine review areas, the first two of which are related to 

the Congressional mandate. It included: (1) analysis of 10 CFR Part 37 inspection 

results from the first 2 years of rule implementation; (2) review of events from the 

Nuclear Material Events Database and the Security Information Database; (3) evaluation 

of the 10 CFR Part 37 trustworthiness and reliability (T&R) program; (4) consideration of 

the definition of aggregation as it applies to well logging sources; (5) assessment of the 

adequacy of the materials security training program for NRC and Agreement State 

inspectors; (6) evaluation of enhanced tracking and accounting of radioactive sources; 

(7) conduct of a comparison to identify and evaluate differences between 

10 CFR Part 37 requirements and international standards and guidance; (8) assessment 

of separate, independent aspects of 10 CFR Part 37 by three external consultants; and 

(9) consideration of comments, questions, and recommendations made during 

stakeholder outreach. 

The results of the NRC staff’s assessment in each the these nine areas are being used 

to inform an overall determination on the effectiveness of 10 CFR Part 37 in fulfilling its 

objective to provide reasonable assurance with respect to the security of Category 1 and 
6 

Category 2 quantities of radioactive material in all applications (e.g., medical, academic, 

industrial) by protecting these materials from theft or diversion. 

7. The GAO 2016 report made three recommendations. Does the NRC intend to 

implement all of the GAO's recommendations, and when will it do so? If any are 

not going to be implemented, please provide your rationale for not moving 

forward to make these improvements. 

The two NRC/Agreement State working groups formed to address the findings of the 

GAO audit have reviewed the three GAO recommendations and will address them in 

their reports. These reports will be finalized this fall and will serve as the basis for 

options on addressing the GAO recommendations that will be presented to the 

Commission. In addition, the Commission is currently considering a proposal by 

Commissioner Baran to re-evaluate Category 3 source accountability that includes the 

staff proposing options on addressing the GAO recommendations. 

Full implementation of the GAO recommendations, if approved by the Commission, 

would require the NRC to amend its regulations in 10 CFR Parts 20, 30, and 32 through 

rulemaking. The rulemaking process, including public comment for the affected groups 

of licensees, generally takes at least 2 years. 

8. Has NRC implemented all of the recommendations from GAO's 2007, 2012, and 

2014 reports? Please provide a status of each of these recommendations. 

The GAO audit reports issued in 2007, 2012, and 2014 made a total of 11 

recommendations. The NRC has taken various actions in response to the GAO 

recommendations. The summary below describes the specific actions taken, or 

currently in process, to address the recommendations. Of those, recommendations, the 

NRC considers two to still be open. First, the recommendation on the definition and 

application of aggregation (GAO used the term “collocation”) is open pending the 

completion of the comprehensive program review of 10 CFR Part 37 (discussed in 

response to Question #6). Second, the recommendation regarding the function of the 

T&R to protect against the insider threat also remains open. The completion of the 

comprehensive program review of 10 CFR Part 37 will provide insights into the 

effectiveness of the T&R process and may result in recommendations for enhancements 

in this area. However, this recommendation will remain open pending the completion of 

Temporary Instruction (TI) 2800/042, “Evaluation of Trustworthiness and Reliability 

Determinations,” and the subsequent review of information gained from the TI. Once the 

review activities have been completed the NRC will pursue closure of these two 

recommendations with the GAO. 

GAO-07-1038T, “Nuclear Security: Actions Taken by NRC to Strengthen Its 

Licensing Process for Sealed Radioactive Sources Are Not Effective” 

Recommendation 1: To avoid inadvertently allowing a malevolent individual or group to 

obtain a license for radioactive materials, NRC should develop improved guidance for 
7 

examining NRC license applications. In developing improved screening criteria, NRC 

should consider whether site visits to new licensees should be mandatory. These 

improved screening criteria will allow NRC to provide reasonable assurance that licenses 

for radioactive materials will only be issued to those with legitimate uses. 

NRC Actions: In 2007, the NRC initiated a working group to enhance the existing pre-licensing 

guidance to further protect against a malevolent individual obtaining a radioactive materials 

license. Enhancements to the guidance included requiring site visits for applicants for new 

licenses or new owners, who are unknown to the NRC, to verify the legitimacy of the applicant, 

and adding enhanced screening criteria for the review of applicants. The guidance, as revised, 

provides instructions on processing new license applications to determine which applicants are 

unknown entities. It also requires a site visit by the regulator and that unknown applicants 

undergo further checks to determine legitimacy. The revised guidance provides instructions on 

the process for performing additional screening checks for unknown applicants, including more 

formal additional checks using existing NRC Office of Investigations’ database resources. The 

revised guidance clearly identifies the roles and responsibilities of NRC offices that will assist in 

the checks, and provides additional guidance on the conduct of pre-licensing site visits to 

determine the legitimacy of applicants. 

After the completion of a 3-month pilot period and the incorporation of comments from the NRC 

regional offices and the Agreement States, the revised guidance was issued in September 

2008. The NRC regional offices immediately implemented the revised guidance. Agreement 

States were permitted a 6-month grace period, starting at the date of issuance of the guidance, 

to incorporate the essential elements of the pre-licensing guidance into their licensing 

processes. The implementation of the essential elements of the pre-licensing guidance is, and 

will continue to be, evaluated during IMPEP reviews of the NRC regional offices and Agreement 

States. 

The NRC and GAO consider this recommendation closed. 

Recommendation 2: NRC should conduct periodic oversight of license application 

examiners so that NRC will be assured that any new guidance is being appropriately 

applied. 

NRC Actions: The NRC’s primary method of oversight of license reviewers and their adherence 

to established practices is through the IMPEP process. IMPEP is used to evaluate the 

performance of NRC regional offices and Agreement State programs using established criteria 

under a series of performance indicators. Typically, IMPEP reviews occur every four years for 

an individual program; however, the reviews may be conducted more frequently if there are 

existing performance issues with respect to a program. Approximately 10-12 IMPEP reviews 

are conducted annually. During an IMPEP review, a review team spends approximately one 

week in the applicable office interviewing technical staff, accompanying inspectors in the field, 

and reviewing documentation. The review team evaluates, among other things, the NRC 

regional office’s or Agreement State’s implementation of the pre-licensing guidance, to ensure 

its proper application. Based on the findings in comparison with the evaluation criteria in NRC 

Management Directive 5.6, “Integrated Materials Performance Evaluation Program (IMPEP),” 

the review team makes an assessment of the overall program performance, as well as 

performance for each indicator. A report is issued to the relevant Agreement State or NRC 

regional office on its performance. Corrective actions, such as program-wide training, are 
8 

implemented for any weaknesses identified by the review team and are subject to follow-up 

review to confirm whether there is program improvement. 

When performance issues that require increased NRC oversight are identified, States may be 

placed on heightened oversight or monitoring. Heightened oversight is a formal process that 

requires the State to develop a program improvement plan. The status of the program 

improvement plan is discussed during bimonthly conference calls between the NRC staff and 

Agreement State program management. States on heightened oversight typically have a followup IMPEP review approximately 1 year after the original IMPEP review. Currently, there are no 

States on heightened oversight. Monitoring is a less formal process that involves quarterly 

conference calls between the NRC staff and Agreement State program management to discuss 

the status of any open performance issues. Currently, there are five States on monitoring. 

In addition, the NRC regional offices perform periodic audits of licensing and inspection 

documentation to ensure that procedures and guidance are being followed. Branch Chiefs 

(first-line supervisors) discuss errors and omissions with individual reviewers, and corrective 

actions are taken at the division level for any generic issues that are identified. The NRC 

encourages all Agreement State programs to use self-assessments as a tool for the State to 

evaluate its own program performance. While the NRC understands that some Agreement 

States do use these tools, these self-assessments are not required. IMPEP teams do not use 

the results of a program’s self-assessment in its evaluation of the program; however, the results 

of a program’s self-assessments may be discussed during periodic meetings that take place 

between IMPEP reviews. Periodic meetings are not formal evaluations, like IMPEP reviews, but 

are open, interactive discussions of program status and performance. Periodic meetings aid in 

the early identification of performance issues. The NRC believes the IMPEP process 

adequately addresses the GAO recommendation. 

The NRC and GAO consider this recommendation closed. 

Recommendation 3: NRC should explore options to prevent individuals from 

counterfeiting NRC licenses, especially if this allows the purchase of more radioactive 

materials than they are approved for under the terms of the original license. 

NRC Actions: The Materials Program Working Group was chartered in 2007 to prepare a report 

that would assess specific and potential security vulnerabilities in NRC’s radioactive materials 

program and provide recommendations to address any identified vulnerabilities. As part of its 

assessment, the working group, comprised of NRC and Agreement State representatives, 

evaluated options to prevent counterfeiting of radioactive materials licenses and improve license 

verification. The working group concluded that properly implemented measures for license 

verification and material tracking will render the physical counterfeiting of a paper license 

ineffective. The working group recommended that the NRC and the Agreement States develop 

mechanisms to verify licensee authorizations and inventory compliance in conjunction with the 

source tracking capabilities of the National Source Tracking System (NSTS). On December 31, 

2008, the NSTS was deployed and made available to NRC and Agreement State licensees to 

track risk-significant sources. The NRC also worked with the Agreement States to develop a 

secure nationwide, web-based LVS, which was deployed on May 31, 2013. LVS enables 

licensees and other authorized individuals to verify that radioactive material transactions are 

authorized and do not exceed license limits by verifying transaction information against the 
9 

regulator’s licensing data. The LVS interfaces with the WBL system, which was deployed on 

August 31, 2012, as a system to maintain radioactive materials licenses. 

The NRC and Agreement States conduct pre-licensing visits to new license applicants to verify 

the validity of the information submitted to obtain a new radioactive material license. Also, new 

regulations were developed for transactions of Category 1 and 2 radioactive materials that 

require licensees to verify with the license-issuing authority that the transferee’s license 

authorizes the receipt of the type, form, and quantity of the radioactive material requested, and, 

for Category 1 shipments, to verify the validity of the address where radioactive material is 

requested to be delivered. These regulations were included in the final rule, 10 CFR Part 37, 

“Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material,” which 

was approved by the Commission and published in the Federal Register on March 19, 2013. 

The rule was effective on May 20, 2013, and NRC licensees were required to be in compliance 

by March 19, 2014. The implementation of the NRC’s web-based LVS and promulgation of 

10 CFR Part 37 addresses this GAO recommendation for NRC and Agreement State 

radioactive material licensees. 

The NRC and GAO consider this recommendation closed. 

GAO-12-925 -- Nuclear Nonproliferation: Additional Actions Needed to 

Improve Security of Radiological Sources at U.S. Medical Facilities 

Recommendation 1: Because the security of radiological sources in hospitals and 

medical facilities has national security implications, and many potentially vulnerable 

medical facilities with high-risk sources have not received security upgrades, the 

Administrator of NNSA, in consultation with the Chairman of NRC and Agreement State 

officials, should increase outreach efforts to promote awareness of and participation in 

NNSA's security upgrade program. Special attention should be given to medical facilities 

in urban areas or in close proximity to urban areas that contain medical equipment with 

high-risk radiological sources. 

NRC Actions: On multiple occasions the NRC has promoted awareness and licensee 

cooperation with the National Nuclear Security Administration (NNSA) Global Material Security 

Program’s (formerly GTRI) Radiological Security Partnership voluntary security enhancements 

to the licensed population, which includes medical facilities nationally. In 2014, the NRC issued 

a publicly available guidance document entitled, “Physical Security Best Practices for the 

Protection of Risk-Significant Radioactive Material,” which includes a comprehensive appendix 

on NNSA’s voluntary security upgrade program, a discussion of the upgrades, available training 

and tabletop exercises, and contact information for licensees interested in participating in the 

program. 

The NRC has promoted awareness of the NNSA upgrade program by discussing it as part of 

the training courses provided to NRC and Agreement State materials inspectors to ensure that 

inspectors can appropriately respond to licensee questions regarding the program. Additionally, 

the NRC has provided presentations to stakeholders that describe the upgrades and their 

availability in the context of the security requirements of 10 CFR Part 37. 
10 

In the past, the NRC issued numerous communications related to the security upgrades. 

Specifically, these communications were provided to all NRC licensees authorized to possess 

Category 1 and Category 2 quantities of radioactive material, all Agreement State Radiation 

Control Program Directors and State Liaison Officers, and members of the Advisory Committee 

on the Medical Uses of Isotopes. Additionally, a short overview of the issue was developed by 

NRC and NNSA, titled, “Partnership for Securing Nuclear and Radioactive Materials,” which 

describes the domestic and international partnership between the two agencies to secure 

radioactive materials and includes discussion of the domestic enhancement program. 

The NRC continues to collaborate with NNSA on a routine basis and supports NNSA’s outreach 

and promotion of its available domestic programs. 

The NRC considers this recommendation closed and plans no further action. The GAO 

considers this recommendation open. 

Recommendation 2: To help address the security vulnerabilities at U.S. hospitals and 

medical facilities that contain high-risk radiological materials, the Chairman of the 

Nuclear Regulatory Commission should strengthen NRC security requirements by 

providing hospitals and medical facilities with specific measures they must take to 

develop and sustain a more effective security program, including specific direction on 

the use of cameras, alarms, and other relevant physical security measures. 

NRC Actions: While the NRC acknowledges that GAO favors prescriptive security regulations, 

the NRC’s existing performance-based security program for licensees who possess risksignificant radioactive materials, including those at medical facilities, is effective and provides 

adequate protection. Performance-based regulation is a key principle of the NRC’s regulatory 

approach that applies to virtually all NRC-regulated activities. A performance-based 

requirement establishes measurable performance standards and provides appropriate flexibility 

to the regulated party as to the means of achieving the mandated outcomes. 

The NRC and the Agreement States verify licensee performance during the inspection process. 

Because of the wide variety of nearly 3,000 licensed facilities affected by security requirements, 

prescribing specific security measures without regard to the type of facility and licensee 

operations may impose excessive and unnecessary requirements and burdens on licensees. In 

other cases, a prescriptive approach may result in a level of protection that is too low. A “onesize-fits-all” prescriptive approach is neither practical nor desirable from a safety or security 

perspective. Security concerns such as those mentioned in the GAO report are effectively 

addressed through established NRC and Agreement State inspection and enforcement 

processes and are not indicative of a weakness in the regulations. 

Since issuance of GAO’s report, the NRC staff has worked with the Agreement States to 

evaluate the examples of security issues documented in the report. The staff has concluded 

that three of the four examples were not compliance issues or security concerns. The 

appropriate Agreement State pursued the fourth example to determine the appropriate 

regulatory response. The GAO report notes concerns that some of the licensee personnel with 

security responsibilities lack expertise in physical security, which may result in inconsistent 

application of security controls. In response to these concerns, the NRC developed and 

provided additional written guidance to instruct licensees on best practices, including specific 
11 

guidance on the effective application of cameras, alarms, and other relevant physical security 

measures to consider in the implementation of their security programs. This “best practices” 

guidance document, “Physical Security Best Practices for the Protection of Risk Significant 

Radioactive Material,” is in addition to the implementing guidance document already developed 

to accompany 10 CFR Part 37: “Implementation Guidance for 10 CFR Part 37, ‘Physical 

Protection of Category 1 and Category 2 Quantities of Radioactive Material.’” 

The NRC considers this recommendation closed and plans no further action. The GAO 

considers this recommendation open. 

Recommendation 3: To help address the security vulnerabilities at U.S. hospitals and 

medical facilities that contain high-risk radiological materials, the Chairman of the 

Nuclear Regulatory Commission should ensure that NRC and Agreement State 

inspectors receive more comprehensive training to improve their security awareness and 

ability to conduct related security inspections. 

NRC Actions: The material security training program provides classroom instruction on a 

performance-based methodology to evaluate and assess the adequacy of a physical protection 

system to protect against theft or diversion of materials subject to the Increased Controls Orders 

(which were in effect at the time of the GAO audit), and was updated to reflect the current 

requirements in 10 CFR Part 37. This training, combined with on-the-job training, periodic 

refresher training, and other requirements to be a qualified radioactive materials safety 

inspector, prepares NRC and Agreement State inspectors to conduct security inspections. 

As part of the implementation of 10 CFR Part 37, the NRC reviewed the inspector qualification 

program for radioactive materials security inspections and revised it accordingly to include 

training on the new rule. In November 2012, a Part 37 Implementation Working Group was 

formed including representatives from across NRC and the Organization of Agreement States. 

This group updated the training modules for inspectors to reflect the Part 37 rule and to include 

additional emphasis on best security practices, including specific guidance on the effective 

application of cameras, alarms, and other relevant physical security measures. This updated 

training class entitled, “NRC Materials Control and Security Systems and Principles,” was first 

offered in February 2014 and is scheduled several times a year. 

The NRC and GAO consider this recommendation closed. 

Recommendation 4: To help address the security vulnerabilities at U.S. hospitals and 

medical facilities that contain high-risk radiological materials, the Chairman of the 

Nuclear Regulatory Commission should supplement existing guidance for facility 

officials, including RSOs, who may be responsible for implementing NRC's security 

controls, in how to adequately secure equipment containing high-risk radiological 

sources and conduct trustworthiness and reliability determinations. 

NRC Actions: The NRC provides guidance to licensees on how to comply with regulatory 

requirements. In November 2012, the 10 CFR Part 37 implementation working group, which 

included representatives from the NRC and the Organization of Agreement States, was formed. 

This group developed a security “best practices” guidance document, “Physical Security Best 

Practices for the Protection of Risk-Significant Radioactive Material,” which was published in 

May 2014. This document provides guidance with specific emphasis on security best practices 
12 

and effective application of security technology that licensees may consider in developing their 

security programs. It is in addition to the implementing guidance document (“Implementation 

Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and Category 2 Quantities of 

Radioactive Material’”) developed to accompany the final rule, 10 CFR Part 37, “Physical 

Protection of Byproduct Material.” 

The NRC considers this recommendation closed and plans no further action. The GAO 

considers this recommendation open. 

GAO-14-293 -- Nuclear Nonproliferation: Additional Actions Needed to 

Increase the Security of U.S. Industrial Radiological Sources 

Recommendation 1: To ensure that the security of radiological sources at industrial 

facilities is reasonably assured, the Chairman of the NRC should obtain the views of key 

stakeholders, such as licensees, during the development of the Best Practices Guide to 

ensure that the guide contains the most relevant and useful information on securing the 

highest risk radiological sources. 

NRC Actions: The NRC agreed with the GAO’s recommendation that the views of key 

stakeholders, such as licensees, should be obtained in developing the guidance document, 

“Physical Security Best Practices for the Protection of Risk Significant Radioactive Material” 

(i.e., the “best practices” guide). Published in May 2014, the “best practices” guide focuses on 

areas of concern that licensees communicated to the NRC during the inspection process. 

As part of the program review of 10 CFR Part 37, the NRC has assessed the effectiveness of 

this guidance document to determine if any revisions are needed and would make revisions 

accordingly using NRC’s public participation process. 

The NRC and GAO consider this recommendation closed. 

Recommendation 2: To ensure that the security of radiological sources at industrial 

facilities is reasonably assured, the Chairman of the Nuclear Regulatory Commission 

should reconsider whether the definition of collocation should be revised for well 

logging facilities that routinely keep radiological sources in a single storage area but 

secured in separate storage containers. 

NRC Actions: The NRC acknowledges the GAO’s recommendation that the definition of 

aggregation (collocation is not used in the regulation) should be reevaluated for well logging 

facilities that routinely keep radiological sources in a single storage area but secured in separate 

containers. Of note, inspection of collocated sources indicates that appropriate security is being 

maintained. 

The NRC is currently reviewing the effectiveness of the 10 CFR Part 37 requirements to 

determine whether any additional security measures, guidance documents (including revising 

“Implementation Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and Category 

2 Quantities of Radioactive Material’,” and “Physical Security Best Practices for the Protection of 
13 

Risk Significant Radioactive Material”), rulemaking changes, or licensee outreach efforts are 

appropriate. The re-evaluation of the definition of aggregation (i.e., collocation) is included in 

this effort. The NRC is on schedule to provide a final report detailing the results of this program 

review to Congress in December 2016. 

The NRC considers this recommendation open pending completion of the 10 CFR Part 37 

program review. The GAO considers this recommendation open. 

Recommendation 3: To ensure that the security of radiological sources at industrial 

facilities is reasonably assured, the Chairman of the Nuclear Regulatory Commission 

should conduct an assessment of the T&R process--by which licensees approve 

employees for unescorted access--to determine if it provides reasonable assurance 

against insider threats, including (1) determining why criminal history information 

concerning convictions for terroristic threats was not provided to a licensee during the 

T&R process to establish if this represents an isolated case or a systemic weakness in 

the T&R process; and (2) revising, to the extent permitted by law, the T&R process to 

provide specific guidance to licensees on how to review an employee's background. 

NRC should also consider whether certain criminal convictions or other indicators 

should disqualify an employee from T&R or trigger a greater role for NRC. 

NRC Actions: The NRC acknowledges the GAO’s recommended assessment of the T&R 

process to determine if it provides reasonable assurance against an insider threat. The current 

T&R requirements that are in place ensure that individuals who have unescorted access to 

Category 1 and Category 2 quantities of radioactive material are trustworthy and reliable and do 

not constitute an unreasonable risk to the public health and safety or security of the radioactive 

material. 

Licensees are required to take a number of actions in order to make a T&R determination for 

unescorted access to Category 1 and 2 quantities of radioactive materials. This includes a 

Federal Bureau of Investigation identification and criminal history records check to determine if 

an individual has a record of criminal activity that would indicate that the individual should not 

have unescorted access to Category 1 and Category 2 quantities of radioactive materials. The 

NRC published “Physical Security Best Practices for the Protection of Risk Significant 

Radioactive Material” in May 2014 to provide additional guidance to licensees in conducting and 

evaluating T&R determinations. The NRC is currently reviewing the effectiveness of the 

10 CFR Part 37 requirements to determine whether any additional security measures, guidance 

updates (including revising “Implementation Guidance for 10 CFR Part 37, ‘Physical Protection 

of Category 1 and Category 2 Quantities of Radioactive Material’,” and “Physical Security Best 

Practices for the Protection of Risk Significant Radioactive Material”), rulemaking changes, or 

licensee outreach efforts are appropriate. The NRC is on schedule to provide a final report 

detailing the results of this program review to Congress in December 2016. 

The completion of the 10 CFR Part 37 program review will provide some insights into the 

effectiveness of the T&R process and may result in recommendations for enhancements in this 

area. Additionally, the staff has issued a Temporary Instruction (TI), “Evaluation of 

Trustworthiness and Reliability Determinations,” and information gained from this TI will be used 

to aid in decision making regarding the overall adequacy of the T&R process. The TI is 

scheduled to be completed in November 2016 and, therefore, a complete assessment of the 
14 

T&R process based on insights from the TI may not be available until after the Part 37 program 

review report to Congress has been completed. 

The NRC considers this recommendation open pending completion of the TI and a follow-up 

assessment of the results. The GAO considers this recommendation open. 

Recommendation 4: To better leverage resources, including expertise, to address 

vulnerabilities associated with radiological sources while in transit, the Administrator of 

NNSA, the Chairman of NRC, and the Secretary of DHS should review their existing 

collaboration mechanism for opportunities to enhance collaboration, especially in the 

development and implementation of new technologies. 

NRC Actions: The NRC agrees with this recommendation and continues to conduct periodic 

meetings with senior management of the referenced agencies to enhance coordination and 

collaboration on overarching technical and policy issues related to source security. The NRC 

routinely collaborates with the NNSA and the Department of Homeland Security (DHS) on a 

range of topics including the security of radiological sources. Both the NNSA and the DHS 

participate, along with other agencies and State representatives, on the Radiation Source 

Protection and Security Task Force, which is chaired by the Chairman of the NRC, consistent 

with the Energy Policy Act of 2005. The NRC also collaborates with these agencies on several 

DHS initiatives regarding radiological materials, including the Global Nuclear Detection 

Architecture and the interagency Government Coordinating Council meeting to address nuclear 

and radiological security issues. 

The NRC and GAO consider this recommendation closed.