Enclosure 

 SUMMARY OF THE NUCLEAR COMMISSION ACTIONS 

RESPONSE TO THE GOVERNMENT ACCOUNTABILITY OFFICE REPORTS

1. Information Security: Federal Agencies Have Taken Steps to Secure Wireless 

Networks, but Further Actions Can Mitigate Risk (GAO-11-42SU)...................................2 

2. The Nuclear Regulatory Commission (NRC): Natural Hazards Assessments Could Be More 

Risk-Informed (GAO-12 465)...................................................................................3 

3. Spent Nuclear Fuel: Accumulating Quantities at Commercial Reactors Present 

Storage and Other Challenges (GAO-12-797)............................................................5 

4. Nuclear Power: Analysis of Regional Differences and Improved Access to Information 

Could Strengthen NRC Oversight (GAO-13-743)....................................................... 6 

5. Information Technology: Additional OMB and Agency Actions Are Needed to Achieve 

Portfolio Savings (GAO-14-65)................................................................................7 

6. Nuclear Nonproliferation: Additional Actions Needed to Increase the Security of U.S. 

Industrial Radiological Sources (GAO-14-293)...........................................................8 

7. Federal Software Licenses: Better Management Needed to Achieve Significant Savings 

Government-Wide (GAO-14-413)...........................................................................10 

8. Nuclear Regulatory Commission: NRC Needs to Improve Its Cost Estimates by 

Incorporating More Best Practices (GAO-15-98)........................................................13 

9. Information Technology Reform: Billions of Dollars in Savings Have Been Realized, but 

Agencies Need to Complete Reinvestment Plans (GAO-15-617)..................................14 

 
2 

Government Accountability Office Report – Information Security: Federal Agencies Have 

Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk 

November 2010 

(GAO-11-42SU)

The U.S. Government Accountability Office (GAO) in its report, “Information Security: Federal 

Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate 

Risk,” made three recommendations to the U.S. Nuclear Regulatory Commission (NRC) to 

improve the security controls with regard to agency use of wireless networks. In response, on 

January 26, 2011, the Chairman of the NRC informed Congress about the actions planned in 

response to the GAO recommendations. The status of the recommendation that remained open 

as of the NRC’s last report is provided below. 

Recommendation 2 

Finalize and implement a written policy for configuring mobile devices when taken on 

international travel or to other potentially risky locations and for applying preventative measures 

to devices when they are returned. 

Status: 

The NRC provided high-level requirements for mobile devices taken on international travel in 

CSOSTD-0020, “Organization Defined Values for System Security Controls,” associated with 

NIST SP-800-53 controls. The NRC continues to develop international travel guidance for NRC 

staff travelling to other countries and standards for the NRC electronic devices taken on such 

travel. The NRC will develop and implement standards for a secure data repository capability 

that can be used by both international and domestic travelers and remote workers. 

This GAO recommendation remains open. 

 
3 

Government Accountability Office Report – Nuclear Regulatory Commission: Natural 

Hazard Assessments Could Be More Risk-Informed 

April 2012 

(GAO-12-465) 

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Regulatory Commission: 

Hazard Assessments Could Be More Risk-Informed,” made a recommendation to the U.S. 

Nuclear Regulatory Commission (NRC) to analyze whether licensees of operating reactors should 

be required to develop Probabilistic Risk Assessments (PRAs) that address natural hazards. In 

response, on July 30, 2012, the NRC Chairman informed Congress about the actions directly 

related to this issue. The status of the recommendation that remained open as of the NRC’s last 

report is provided below. 

Recommendation 

Analyze whether licensees of operating reactors should be required to develop PRAs that 

address natural hazards. 

Status: 

Although the NRC does not currently require PRAs for operating reactors, all operating reactor 

licenses have developed internal event PRA models and, in many cases, external event 

models. In addition, to evaluate the effects of recent seismic hazard reevaluations, a number of 

licensees are developing seismic PRAs. 

The NRC has undertaken several independent activities to assess the risk of natural hazards at 

operating reactors. For example, the NRC’s Office of Nuclear Regulatory Research has been 

conducting a pilot project to conduct a Level 3 PRA for Vogtle Electric Generating Plant, Units 1 

and 2. This Level 3 PRA effort encompasses natural hazards typically considered in previous 

external event PRAs (e.g., seismic events, tornadoes, hurricanes, and external flooding), and 

addresses the impact of these natural hazards on one or both operating reactors at the site, as 

well as on spent fuel stored on site (in either pools or dry casks). This study may identify 

accident prevention, accident mitigation, and emergency planning improvements for the 

reactors, the spent fuel pools, and dry cask storage in response to natural hazards or other 

causes. This Level 3 PRA pilot project and its potential uses are discussed in SECY-12-0123, 

“Update on Staff Plans to Apply the Full-Scope Site Level 3 PRA Project Results to the NRC’s 

Regulatory Framework,” dated September 13, 2012. 

In addition, the NRC has taken steps to advance the state of knowledge with regard to flooding 

risk assessments. In response to Commission direction, the NRC staff developed a multi-year 

probabilistic flood hazard assessment research plan (Agencywide Document Access and 

Management System Accession No. ML14296A442) that will help in the development of 

flooding PRAs in the future. 

Finally, the NRC staff is currently evaluating other natural hazards (extreme winds, extreme 

temperatures, drought and other low-water conditions, and winter precipitation that results in 

snow and ice loading on structures) as part of its response to the accident at Fukushima Dai-ichi 

and Congressional direction included in the Consolidated Appropriations Act, 2012 (Public Law 

112-74). The Commission has approved the staff’s plan to address this issue and will receive 

the results of the staff’s screening of relevant natural hazards later in 2016. 
4 

In 2011, former NRC Commissioner George Apostolakis led a risk management task force to 

consider a more comprehensive, holistic, risk-informed, performance-based regulatory 

approach for nuclear reactors, as well as for materials, waste, the fuel cycle, and transportation. 

An interoffice working group then considered the task force report, as well as other related riskinformed activities, in preparing options for future risk-informed regulation. The related 

Commission paper SECY-15-0168, “Recommendations on Issues Related to Implementation of 

a Risk Management Regulatory Framework,” was issued on December 18, 2015. Commission 

direction resulting from SECY-15-0168 will enable the NRC staff to fully disposition this GAO 

recommendation. 

This GAO recommendation remains open. 

 
5 

Government Accountability Office Report – Spent Nuclear Fuel: Accumulating Quantities 

at Commercial Reactors Present Storage and Other Challenges 

August 2012 

(GAO-12-797) 

The U.S. Government Accountability Office (GAO), in its report, “Spent Nuclear Fuel: 

Accumulating Quantities at Commercial Reactors Present Storage and Other Challenges,” 

recommended that the U.S. Nuclear Regulatory Commission (NRC) develop a mechanism for 

identifying and accessing all classified studies to help facilitate decisions on storing and 

disposing of spent nuclear fuel over the coming decades. The status of the recommendation 

that remained open as of the NRC’s last report is provided below. 

Recommendation 

To help facilitate decisions on storing and disposing of spent nuclear fuel over the coming 

decades, the Chairman of the NRC should direct agency staff to develop a mechanism that 

allows individuals with appropriate clearances and the need to know to easily identify and 

access classified studies so as to help ensure that institutional knowledge is not lost. 

Status: 

The NRC staff committed to developing and implementing a pilot program database to include 

unclassified information detailing key attributes of classified documents to identify location and 

points of contact. The pilot program was completed in 2013, and the NRC staff completed a 

second, expanded pilot program in December 2014. The scope of the expanded pilot program 

extended beyond spent nuclear fuel studies and included a representative sampling of all 

classified documents and media received and produced by the NRC. To address concerns 

regarding classification by compilation, during the course of the second pilot program, the 

participants developed a localized catalog of the classified documents and media in their 

possession and tracked the level of effort associated with completing this task. The staff 

compiled the data gathered from the second pilot program and documented lessons learned 

regarding classified records management at the NRC. 

In April 2015, the NRC staff provided the Commission with the following recommendations for 

maintaining accountability of all classified documents and media received and produced by the 

NRC in the future: 

(1) Institute annual classified information clean-up days at the NRC Headquarters and 

regional facilities; 

(2) Develop security plans for General Services Administration-approved safes with local 

catalogs of safes’ contents; 

(3) Provide classified records management training to applicable staff; and 

(4) Expand use of the National Archives and Records Administration’s Federal Records 

Centers. 

These recommendations are scheduled to be implementetd by the end of the 2016 calendar 

year. 

This GAO recommendation remains open. 

 
6 

Government Accountability Office Report 13-743 – Nuclear Power: Analysis of Regional 

Differences and Improved Access to Information Could Strengthen NRC Oversight 

September 2013 

(GAO-13-743)

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Power: Analysis of

Regional Differences and Improved Access to Information Could Strengthen NRC Oversight,” 

made three recommendations to the U.S. Nuclear Regulatory Commission (NRC) regarding 

identification, resolution, and tracking of inspection findings. In response, on December 16, 

2013, the Chairman of the NRC informed Congress about the planned response to the 

recommendations identified by GAO. The status of the recommendation that remained open as 

of the NRC’s last report is provided below. 

Recommendation 3 

To help the NRC staff more efficiently use past experiences in its oversight activities, the NRC

Commissioners direct agency officials to evaluate the challenges inspectors face in retrieving 

all relevant information on plant performance and previous oversight activities, and improve its

systems accordingly to address these challenges. 

Status: 

The NRC is making plant performance and oversight information more readily searchable and

available to NRC inspection staff and other appropriate NRC personnel. As an example, the 

NRC is working to upgrade the Reactor Program Systems software and improve staff access to 

operating experience. The NRC plans to integrate these changes with an update to the internal 

Resident Inspector webpage. These enhancements are estimated to be completed in fiscal 

year (FY) 2017. In addition, the NRC has implemented new methods for soliciting anonymous

feedback/comments on administrative and support concerns relevant to Resident Inspectors. 

This GAO recommendation remains open. 

 
7 

Government Accountability Office Report – Information Technology: Additional OMB 

and Agency Actions Are Needed to Achieve Portfolio Savings 

November 2013

(GAO-14-65)

The U.S. Government Accountability Office (GAO), in its report, “Information Technology: 

Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings,” reviewed the 

Office of Management and Budget’s (OMB) policy, requirements, and implementation of the 

2012 PortfolioStat initiative, a process whereby 26 Federal agencies, including the U.S. 

Nuclear Regulatory Commission (NRC), gather information on their information technology (IT) 

investments and develop plans for consolidation and increased use of shared service delivery 

models. To improve the NRC’s implementation of PortfolioStat, GAO made two 

recommendations. The status of the recommendation that remained open as of the NRC’s 

last report is provided below. 

Recommendation 1 

Develop a complete commodity IT baseline. 

Status: 

The NRC is still developing a complete commodity IT baseline. There are a number of steps 

required to develop this baseline. These include centralizing IT commodity spending and then 

developing an NRC commodity IT baseline aligned with OMB policy. 

The NRC continues to make progress in centralizing its IT commodity spending under the 

Office of the Chief Information Officer. The NRC has restructured its IT portfolio to provide 

greater transparency regarding IT costs, including commodity IT. The NRC Financial 

Accounting and Integrated Management Information System (FAIMIS) now provides detailed 

reports of IT spending by contract. The NRC is also using its IT Portfolio Council to analyze 

commodity categorizations and IT spending within those categories. 

Starting in FY 2016, OMB began issuing a number of category policy memos to help agencies 

develop the commodity IT baseline. The first IT category management policy memorandum, 

OMB M-16-02, established new acquisition and workstation management policies across the 

Federal Government. The OMB M-16-02 plan asks agencies to report details about contracts 

and contract spending. NRC will provide the transition and implementation plan to OMB by 

February 29, 2016. 

This GAO recommendation remains open. 

 
8 

Government Accountability Office Report – Nuclear Nonproliferation: Additional Actions 

Needed to Increase the Security of U.S. Industrial Radiological Sources 

June 2014 

(GAO-14-293)

The U.S. Government Accountability Office (GAO), in its report, “Nuclear Nonproliferation:

Additional Actions Needed to Increase the Security of U.S. Industrial Radiological Sources,” 

made three recommendations solely to the U.S. Nuclear Regulatory Commission (NRC) and 

one recommendation jointly to the NRC, the U.S. Department of Energy and the U.S. 

Department of Homeland Security regarding security at NRC-licensed and Agreement-Statelicensed facilities using high-risk industrial radiological sources. The status of the 

recommendations that remained open as of the NRC’s last report is provided below. 

Recommendation 2 

To ensure that the security of radiological sources at industrial facilities is reasonably 

assured, the Chairman of the NRC should reconsider whether the definition of collocation 

should be revised for well logging facilities that routinely keep radiological sources in a 

single storage area but secured in separate storage containers. 

Status: 

The NRC acknowledges the GAO’s recommendation that the definition of collocation should 

be re-evaluated for well logging facilities that routinely keep radiological sources in a single 

storage area, but secured in separate containers. Inspection of collocated sources indicates 

that appropriate security is being maintained by licensees. The NRC is currently reviewing 

the effectiveness of the 10 CFR Part 37 requirements to determine whether any additional 

security measures, guidance documents (including revising NUREG-2155, “Implementation 

Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and Category 2 Quantities of 

Radioactive Material’” and the Best Practices Guide), rulemaking changes or licensee 

outreach efforts are appropriate. The re-evaluation of the definition of collocation is included 

in this effort. A final report, detailing the results of this program review is scheduled to be 

provided to Congress in December 2016. 

This GAO recommendation remains open. 

Recommendation 3 

To ensure that the security of radiological sources at industrial facilities is reasonably 

assured, the Chairman of the NRC should conduct an assessment of the trustworthiness and 

reliability (T&R) process--by which licensees approve employees for unescorted access--to 

determine if it provides reasonable assurance against insider threats, including (1) 

determining why criminal history information concerning convictions for terroristic threats was 

not provided to a licensee during the T&R process to establish if this represents an isolated 

case or a systemic weakness in the T&R process; and (2) revising, to the extent permitted by 

law, the T&R process to provide specific guidance to licensees on how to review an 

employee's background. The NRC should also consider whether certain criminal convictions 

or other indicators should disqualify an employee from T&R or trigger a greater role for NRC. 

 
9 

Status: 

The NRC acknowledges the GAO’s recommended assessment of the T&R process to 

determine if it provides reasonable assurance against an insider threat. The current T&R 

requirements are in place to ensure that individuals who have unescorted access to 

category 1 and category 2 quantities of radioactive material are trustworthy and reliable and 

do not constitute an unreasonable risk to the public health and safety or security of the 

radioactive material. 

Licensees are required to conduct a number of activities, pursuant to 10 CFR 37.25, in order 

to make a T&R determination for unescorted access to category 1 and 2 quantities of 

radioactive materials. This includes a Federal Bureau of Investigation identification and 

criminal history records check to determine if an individual has a record of criminal activity 

that indicates that the individual should not have unescorted access to category 1 and 

category 2 quantities of radioactive materials. The NRC published “Physical Security Best 

Practices for the Protection of Risk Significant Radioactive Material” in May 2014, which 

provides additional guidance to licensees in conducting and evaluating T&R determinations. 

The NRC is reviewing the effectiveness of the 10 CFR Part 37 requirements to determine 

whether any additional security measures, guidance updates (including revising NUREG2155, “Implementation Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and 

Category 2 Quantities of Radioactive Material’” and the Best Practices Guide), rulemaking 

changes or licensee outreach efforts are appropriate. An assessment of the T&R process 

will be included as part of this program review. A final report detailing the results of this 

program review, is scheduled to be provided to Congress in December 2016. 

This GAO recommendation remains open.

 
10 

Government Accountability Office Report – Federal Software Licenses: Better 

Management Needed to Achieve Significant Savings Government-Wide 

May 2014 

(GAO-14-413) 

The U.S. Government Accountability Office (GAO), in its report “Federal Software Licenses: 

Better Management Needed to Achieve Significant Savings Government-Wide,” made 

recommendations to many government entities, including the U.S. Nuclear Regulatory 

Commission (NRC), to ensure the effective management of software licenses. The status of the 

recommendations that remained open as of the NRC’s last report is provide below. 

Recommendation 1 

Develop an agency-wide comprehensive policy for the management of software licenses that 

address the weaknesses identified by GAO. 

Status: 

The NRC has developed a framework and maturity model for Software Asset Management 

(SAM) and is developing an activity plan to further integrate governance, processes and 

technology. The NRC is also developing an acquisition strategy for a SAM tool as part of a 

strategic realignment of the agency’s infrastructure and support services contract in 2017. 

This GAO recommendation remains open. 

Recommendation 2 

Employ a centralized software license management approach that is coordinated and integrated 

with key personnel for the majority of agency software license spending and/or enterprise-wide 

licenses. 

Status: 

The NRC has defined current and future needs for a centralized software license management 

approach, including process maps developed to identify the roles and responsibility of each key 

stakeholder for key high level processes for software management. The NRC will continue to 

define core processes as part of its overall IT strategy. 

This GAO recommendation remains open. 

Recommendation 3 

Establish a comprehensive inventory of software licenses using automated tools for the majority 

of agency software license spending and/or enterprise-wise licenses. 

 
11 

Status: 

The NRC is continuing to centralize and standardize purchases of software licenses. Currently, 

software that is managed through the Information Technology Infrastructure Support Services 

(ITISS) contract are maintained using automated tools. The NRC is also developing an 

acquisition strategy for a SAM tool as part of a strategic realignment of the agency’s 

infrastructure and support services contract in 2017. 

This GAO recommendation remains open. 

Recommendation 4 

Regularly track and maintain a comprehensive inventory of software licenses using automated 

tools and metrics. 

Status: 

The NRC comprehensively reviewed the governance, processes and technology relating to 

NRC’s management of software assets. As part of this assessment, the requirements for 

automated tools were identified. As discussed above, the NRC is developing an acquisition 

strategy for a SAM tool as part of a strategic realignment of the agency’s infrastructure and 

support services contract in 2017. 

This GAO recommendation remains open. 

Recommendation 5 

Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, 

to identify opportunities to reduce costs and better inform investment decision making. 

Status: 

The NRC has developed a SAM framework and maturity model and is continuing to centralize, 

standardize, and consolidate purchases of software licenses and enterprise-wide initiatives. 

Additionally, NRC is in the process of completing a future state roadmap and activity plan which 

will assist the agency in making informed decisions regarding SAM. As discussed above, the 

acquisition strategy for a software asset management tool to perform these analyses, identify 

opportunities to reduce costs, and improve investment decision-making is in alignment with the 

re-compete of the agency’s infrastructure and support services contract in 2017. 

This GAO recommendation remains open. 

Recommendation 6 

Provide software license management training to appropriate agency personnel addressing 

contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, 

and configuration management. 
12 

Status: 

NRC employees with an acquisition role receive significant training required for the Federal 

Acquisition Certification. For the software license topic specifically referenced in the 

recommendation, as described above, the NRC is considering its management of software 

assets as part of its overall IT strategy. Once the policy is established and the software asset 

management tool is acquired, the NRC will provide appropriate training to agency personnel 

addressing contract terms and conditions, negotiations, laws and regulations, acquisition, 

security planning, and configuration management. This is in alignment with the re-compete of 

the agency’s infrastructure and support services contract in 2017. 

This GAO recommendation remains open. 

 
13 

Government Accountability Office Report - Nuclear Regulatory Commission: NRC Needs 

to Improve Its Cost Estimates by Incorporating More Best Practices 

December 2014 

(GAO-15-98) 

In GAO-15-98, the U.S. Government Accountability Office (GAO) recommended that the 

U.S. Nuclear Regulatory Commission (NRC) align its procedures with relevant cost-estimating 

best practices identified in GAO-089-3SP, “GAO Cost Estimating and Assessment Guide: Best 

Practices for Developing and Managing Capital Program Costs” (March 2009). In response, on 

February 10, 2015, the NRC’s Chairman informed Congress of the actions the NRC planned to 

take in response to GAO’s recommendation. The status of the actions described in that 

response is provided below. 

Recommendation 

To improve the reliability of its cost estimates, we recommend that, as the NRC revises its cost 

estimating procedures, the NRC Chairman ensures that the agency aligns the procedures with 

relevant cost estimating best practices identified in the GAO Cost Estimating and Assessment 

Guide and ensure that future cost estimates are prepared in accordance with relevant cost 

estimating best practices. 

Status: 

The NRC staff agrees with GAO’s statement that the NRC could improve its regulatory 

analyses, and the NRC has efforts underway to do so. The NRC has discussed its efforts with 

GAO. The NRC does not, however, believe that the standards GAO used to assess our 

program, set forth in the GAO Cost Estimating and Assessment Guide, are appropriate for the 

types of analyses the NRC prepares. The standards in the GAO guide apply to evaluating 

Federal agency capital expenditures (acquisitions). By contrast, the NRC uses the regulatory 

analyses to evaluate proposed actions affecting entities that the NRC regulates. For these 

types of actions, the NRC follows standard Federal agency practice by using Office of 

Management and Budget (OMB) guidance on the attributes of a regulatory analysis (OMB 

Circular A-4, “Regulatory Analysis”). 

The NRC includes OMB Circular A-4 as an essential reference in our guidance on preparing 

regulatory analyses for rulemakings and other regulatory actions. Consistent with OMB Circular 

A-4, and in response to certain recommendations in GAO-15-98, the NRC staff is updating the 

content and structure of its cost-benefit guidance documents. In particular, the NRC is updating 

NUREG/BR-0058, “Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory 

Commission,” and NUREG/BR-0184, “Regulatory Analysis Technical Handbook.” 

As the NRC updates its cost-benefit guidance documents, we are considering relevant best 

practices and feedback that GAO has provided. The NRC is also considering input from the 

NRC’s Office of the Inspector General, NRC licensees, the Nuclear Energy Institute, and other 

stakeholders. The NRC’s updates to our cost-benefit guidance documents are currently in 

progress, and the draft guidance is expected to be issued for public comment in the fall of 2016. 

This GAO recommendation remains open. 
14 

Government Accountability Office Report – Information Technology Reform: 

Billions of Dollars in Savings Have Been Realized, but Agencies Need to Complete 

Reinvestment Plans 

September 2015 

(GAO-15-617) 

The U.S. Government Accountability Office (GAO), in its report, “Information Technology 

Reform: Billions of Dollars in Savings Have Been Realized, but Agencies Need to Complete 

Reinvestment Plans,” reviewed the information technology (IT ) agency cost savings resulting 

from data center consolidation and PortfolioStat actions since 2012 to determine how agencies 

reinvested their savings. GAO’s objectives were to (1) assess agencies’ progress in 

achieving savings from their IT reform efforts; (2) evaluate the extent to which agencies have 

established plans to reinvest their savings; and (3) evaluate how selected agencies have 

reinvested their savings, including the extent to which IT governance processes are in place 

to oversee such reinvestments. GAO recommended the Chairman of the U.S. Nuclear 

Regulatory Commission direct the Chief Information Officer to take the following two actions. 

Recommendation 1 

As part of any future update to the agency’s information resources management strategic plan 

or equivalent document, include information regarding the approach to reinvesting savings 

from the consolidation of commodity IT resources (including data centers) in accordance with 

OMB’s guidance. 

Status: 

The next NRC IT/IM Strategic Plan revision is scheduled for February 2018. This date is in 

alignment with the Government Performance and Results Modernization Act of 2010. The 

Strategic Plan revision will include, in accordance with OMB guidance, information regarding 

the approach to reinvesting savings from the consolidation of commodity IT resources 

(including data centers). 

This GAO recommendation remains open.

Recommendation 2 

Ensure that the agency’s integrated data collection submission to OMB includes, for all 

reported initiatives, complete plans to reinvest any resulting cost savings and avoidances from 

OMB-directed IT reform-related efforts. 

Status: 

OMB informed NRC that the quarterly integrated data collection instruction is being revised to 

include agency submission of plans to reinvest cost savings and avoidances. NRC will 

implement the necessary process to meet the new OMB data submission requirements. 

 

This GAO recommendation remains open.