1 

`
Executive Summary 

This report provides the results of a program review conducted pursuant to Section 403 of 

Public Law 113-235, “Consolidated and Further Continuing Appropriations Act, 2015,” 

(Appropriations Act). This act required that the U.S. Nuclear Regulatory Commission (NRC) 

assess the effectiveness of Title 10 of the Code of Federal Regulations (10 CFR) Part 37, 

“Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material,” 2 years 

following its implementation by NRC licensees. The effectiveness evaluation for Agreement 

State licensees will be conducted separately by the Government Accountability Office as 

required by the Appropriations Act. 

The NRC took steps to strengthen the security of risk-significant radioactive materials after the 

terrorist attacks of September 11, 2001, by issuing a series of security Orders to its licensees to 

implement interim security measures. Subsequently, the NRC published 10 CFR Part 37 on 

March 19, 2013 (78 FR 16922), to establish security requirements for the use and transport of 

Category 1 and 2 quantities of radioactive material. This final rule replaced the security Orders. 

The review of the rule’s effectiveness, which is documented in this report, was conducted 

through an analysis of events and inspection findings related to the security of risk-significant 

radioactive materials. This review was supplemented by an integrated assessment of the clarity 

and effectiveness of the rule, associated guidance documents, and implementation thereof 

conducted by NRC staff and expert Independent Assessment Consultants. In totality, these 

activities formed the basis for assessing the adequacy of the regulatory infrastructure for 

security of these radioactive materials. 

The assessment showed that the requirements in Part 37 are effective in ensuring the security 

of risk-significant radioactive materials during use, storage, and transport when implemented 

appropriately by licensees. However, the assessment did identify a number of implementation 

issues due to licensees’ incomplete understanding of differences between requirements in the 

rule and requirements in the Orders issued by the NRC to strengthen the security of risksignificant radioactive materials after the terrorist attacks of September 11, 2001. 

Additionally, the NRC identified potential enhancements to the rule and guidance that could 

improve the clarity of the rule and consistency in its implementation. 
Table of Contents 

1.0 Introduction ........................................................................................................................ 1 

2.0 Background – Statutory Authority and Evolution of Radioactive Source Security .............. 1 

2.1 Atomic Energy Act of 1954, as amended ....................................................................... 1 

2.2 Energy Reorganization Act of 1974 ................................................................................ 1 

2.3 Energy Policy Act of 2005 .............................................................................................. 2 

2.4 Evolution of Regulatory Framework for Radioactive Source Security ............................ 2 

2.4.1 Control of Radioactive Material ............................................................................... 2 

2.4.2 Enhanced Security .................................................................................................. 2 

2.4.3 Security and Control Requirements for Category 1 and 2 Materials ....................... 3 

3.0 Oversight of Risk-significant Radioactive Material ............................................................. 4 

3.1 NRC’s Licensing and Oversight Process ........................................................................ 4 

3.1.1 Pre-licensing Activities ............................................................................................ 4 

3.1.2 Inspection ................................................................................................................ 5 

3.1.3 Enforcement ............................................................................................................ 5 

3.2 Overview of NRC Source Security Program Features.................................................... 6 

3.2.1 Threat Assessment ................................................................................................. 6 

3.2.2 Information Technology Applications ...................................................................... 7 

4.0 NRC Assessment of 10 CFR Part 37 ................................................................................. 8 

4.1 Inspection Results .......................................................................................................... 8 

4.2 Events ........................................................................................................................... 13 

4.3 Additional Assessment Activities .................................................................................. 16 

5.0 Conclusion ....................................................................................................................... 18 

Appendix A: Acronyms and Abbreviations ................................................................................. 20 
1 

1.0 Introduction 

Section 403 of Public Law 113-235, “Consolidated and Further Continuing Appropriations Act, 

2015,” (Appropriations Act) required the U.S. Nuclear Regulatory Commission (NRC) to 

evaluate the effectiveness of the requirements of Part 37 of Title 10 of the Code of Federal 

Regulations (10 CFR), “Physical Protection of Category 1 and Category 2 Quantities of 

Radioactive Material,” and determine whether those requirements are adequate to protect “highrisk radiological material.”1 This report fulfills that 

directive to assess the effectiveness and consider 

“inspection results and event reports from the first 

2 years of implementation of the requirements in 

10 CFR Part 37 for NRC licensees.” Discussion 

on the Agreement State program is provided in 

this report in brief. The effectiveness evaluation 

for Agreement State licensees will be conducted 

separately by the Government Accountability 

Office (GAO) as required by the Appropriations 

Act. 

2.0 Background – Statutory Authority and 

Evolution of Radioactive Source 

Security 

2.1 Atomic Energy Act of 1954, as 

amended 

Under the Atomic Energy Act of 1954, radioactive 

sources generally fall within the definition of 

byproduct material, and are therefore subject to 

licensing under 10 CFR Part 30, “Rules of 

General Applicability to Domestic Licensing of 

Byproduct Material,” of NRC’s regulations and to 

compliance with other applicable regulatory 

requirements, such as 10 CFR Part 20, 

“Standards for Protection Against Radiation.” 

2.2 Energy Reorganization Act of 1974 

The NRC was established in 1974, as an 

independent agency, from a portion of the former 

Atomic Energy Commission, to regulate the 

civilian use of byproduct material, source 

material, and special nuclear material to protect 

public health and safety, to promote the common 

defense and security, and to protect the 

environment. The NRC meets this mission 

 

1

 Although the legislation uses the term “high risk,” the Radiation Source Protection and Security Task Force and the NRC use the 

term “risk-significant.” Risk-significant quantities of radioactive material are defined as those meeting the thresholds for Category 1 

and Category 2 as included both in the International Atomic Energy Agency (IAEA) Code of Conduct on the Safety and Security of 

Radioactive Sources and in Part 37. 

AGREEMENT STATE 

PROGRAM 

The Atomic Energy Act authorizes the 

NRC to relinquish to individual states 

portions of its regulatory authority to 

license and regulate byproduct 

materials. The mechanism for the 

transfer of NRC’s authority to a state is 

an agreement signed by the governor 

of the state and the Chairman of the 

NRC. Such states are thus referred to 

as “Agreement States,” of which there 

are currently 37. 

The NRC’s Integrated Materials 

Performance Evaluation Program 

ensures the protection of public health 

and safety through routine evaluation 

of Agreement States’ regulatory 

oversight of licensees under their 

jurisdiction and provides NRC and 

Agreement State management with a 

systematic and integrated approach to 

evaluate the strengths and 

weaknesses of their nuclear material 

licensing and inspection programs. 
2 

through licensing, inspection, and enforcement of its regulatory requirements. 

2.3 Energy Policy Act of 2005 

The Energy Policy Act of 2005 created the Radiation Source Protection and Security Task 

Force (Task Force). The Task Force is charged with evaluating the security of radiation sources 

in the U.S. from potential terrorist threats, including acts of sabotage, theft, or use of a radiation 

source in a radiological dispersal device or a radiation exposure device, and recommending 

regulatory or legislative changes as appropriate to the President and the U.S. Congress. The 

Task Force is comprised of representatives from 14 Federal agencies and one State 

organization, and is led by the Chairman of the NRC (or designee). The Task Force is in its 12th

year and continues to meet routinely to work toward closure of open recommendations and to 

address additional concerns, such as any changes in the threat level related to radiological 

materials that may arise over time. 

2.4 Evolution of Regulatory Framework for Radioactive Source Security 

2.4.1 Control of Radioactive Material 

Since the establishment of the NRC, it has been a requirement, that licensees, including those 

who possess Category 1 and 2 quantities of radioactive material, must control access to areas 

where licensed material is either used or stored to prevent the unnecessary exposure of 

members of the public, and to prevent theft. This is commonly achieved by posting signs, 

locking devices, locking areas where licensed materials are stored, and maintaining constant 

control and continuous surveillance of areas where materials are used. Every licensee is 

required to develop operating and emergency procedures that include steps for authorized 

users to ensure that access to licensed materials is controlled for the types of operations that 

will be performed. These requirements are found in Parts 20 and 30. 

2.4.2 Enhanced Security

After the terrorist attacks of September 11, 2001, the NRC determined that there was a need for 

heightened awareness and focus on ensuring the prevention of intentional unauthorized access 

to radioactive materials to carry out potential malicious acts. As a result, the NRC imposed 

additional security controls to supplement the existing regulatory requirements in order to 

ensure adequate protection of, and minimize danger to, the public health and safety and the 

common defense and security. The additional security requirements were consistent with the 

International Atomic Energy Agency’s (IAEA) Code of Conduct on the Safety and Security of 

Radioactive Sources Category 1 and Category 2 thresholds. These thresholds were separately 

reaffirmed by the Task Force to warrant the greatest level of control since they present the 

greatest risk for potential use in a radiological dispersal device. The requirements for Category 

1 or 2 quantities of radioactive materials encompassed background checks, fingerprinting, 

access control, physical security during use, and physical security during transport. 

The requirements were imposed by order to different classes of licensees, phased in from 

highest to lowest risk. The initial set of Orders were issued to specific licensees under the 

common defense and security provisions of the Atomic Energy Act, the enforcement of which 

was only by the NRC. These Orders applied to NRC and Agreement State licensees operating 

panoramic irradiators with more than 370 Terabecquerels (10,000 curies) of radioactive 

material; certain licensees authorized to manufacture or distribute Category 1 or 2 quantities of 

radioactive material; and licensees transporting Category 1 quantities of radioactive material. 

The Orders required licensees to implement compensatory measures, additional security 

measures, or increased controls to enhance the protection of radioactive materials in quantities 
3 

of concern. The 

Orders also 

required licensees 

to require 

fingerprinting and 

FBI criminal history 

records checks for 

unescorted access 

to risk-significant 

quantities of 

radioactive material 

at their facilities. 

Following the 

implementation of 

these Orders, the 

NRC and 

Agreement States 

subsequently 

issued Orders and 

legally-binding 

license conditions 

pursuant to the 

public health and safety provisions of the Atomic Energy Act to the remaining licensees 

authorized to possess Category 1 and 2 quantities of radioactive materials (e.g., medical 

facilities, academic institutions, research facilities, and other facilities). The additional security 

requirements imposed by the Orders and lessons learned from their implementation were used 

as the starting basis for the development of Part 37, which was published on March 19, 2013. 

The NRC licensees were required to implement the rule requirements no later than March 19, 

2014, while Agreement States implemented Part 37-compatible requirements on or before 

March 19, 2016. The Orders discussed above have been rescinded as the Part 37 

requirements, Agreement State regulations, or equivalent legally binding requirements, took 

effect for licensees. 

2.4.3 Security and Control Requirements for Category 1 and 2 Materials 

In addition to the requirements of Part 20, Part 30, and other specific regulatory requirements, 

licensees that possess aggregated2 Category 1 and 2 materials must implement security 

measures in accordance with the requirements of Part 37. Key requirements of Part 37 include: 

• Conducting background checks, including (1) fingerprinting to help ensure that 

individuals with unescorted access to risk-significant radioactive materials are 

trustworthy and reliable and (2) protection of certain information from unauthorized 

disclosure. 

• Controlling personnel access to areas where risk-significant radioactive materials are 

stored and used. 

 

2 As defined in 10 CFR Part 37, radioactive materials are “aggregated” if the breach of a single physical barrier would 

allow access to radioactive material in any form, including any devices that contain the radioactive material, when the 

total activity equals or exceeds a Category 2 quantity of radioactive material. 
4 

• Documenting security programs that are designed with defense in depth to detect, 

assess, and respond to actual or attempted unauthorized access events. 

• Planning of coordination and response between the licensee and local law enforcement 

agency (LLEA). 

• Coordinating and tracking of radioactive materials shipments. 

• Using security barriers to discourage theft of portable devices. 

• Timely reporting of events to LLEA and the regulatory authority. 

As required by the AEA, Agreement State programs must be compatible with the Commission’s 

regulatory program. Therefore, as mentioned above, all Agreement States have implemented 

regulations or legally binding license conditions on or before March 19, 2016, to be compatible 

with Part 37. 

3.0 Oversight of Risk-significant Radioactive Material 

The NRC and Agreement States regulate the facilities, personnel, program controls, and 

equipment involved in the civilian use of radioactive materials in medical, academic, and 

industrial settings. The licensing and inspection oversight provided by the NRC and Agreement 

States, consistent with the regulatory framework provided in the Code of Federal Regulations, 

ensures the safety of the public, patients, the environment, and workers who might be exposed 

to radiation from those materials. 

The physical security requirements of Part 37 apply to all licensees that possess radioactive 

material that aggregates to or exceeds a Category 2 quantity. For some facilities, radioactive 

material may not be in the form of a discrete radioactive source. For example, material made 

radioactive inside a nuclear reactor, such as reactor vessel internal components, would be 

subject to the requirements of Part 37 if it met or exceeded the Category 2 threshold. Security 

for radioactive material at reactor and fuel cycle facilities is maintained consistent with both Part 

37 and the security plans and procedures required by relevant sections of Part 73, “Physical 

Protection of Plants and Materials.” 

3.1 NRC’s Licensing and Oversight Process 

The NRC protects public health and safety, promotes the common defense and security, and 

protects the environment through a comprehensive process of reviewing licensing applications 

against the agency’s regulations, by performing routine and reactive inspections to assess 

licensee compliance with those regulations, and through the enforcement program. The NRC 

performs policy-setting activities including rulemaking and associated guidance development to 

ensure that the regulatory framework is commensurate with the risk associated with licensed 

activities. The NRC seeks to perform these activities in an open and transparent manner, 

sharing information with the public to the maximum extent possible, and performing frequent 

outreach to licensees and communication with stakeholders. 

3.1.1 Pre-licensing Activities

Prior to issuing a materials license, the NRC conducts a pre-licensing review. The purpose of 

this review is to: 

• Screen all unknown applicants to determine their legitimacy; 
5 

• Screen existing licensees (beyond the review conducted in the initial application) that 

increase possession limits to a Category 2 or higher quantity of radioactive material; 

• Conduct site visits at applicant facilities to assure that radioactive material will be used 

as specified on the license application; and 

• Forward suspicious applications to the appropriate authority for follow-up. 

Pre-licensing activities also include the use of a 

checklist to address requests for authority to possess 

risk-significant radioactive material. The essential 

objective of the checklist is to identify those applicants 

and licensees that require implementation of the 

security requirements in Part 37. An onsite security 

review or an initial security inspection is conducted to 

verify that applicants or licensees requesting authority 

to possess aggregated Category 1 or 2 quantities of 

radioactive material are prepared to implement the 

applicable security requirements before taking 

possession of those materials. 

3.1.2 Inspection 

A primary component of the NRC’s oversight involves 

an established inspection program for licensees 

authorized to possess, use, transfer, and dispose of 

radioactive material. This program is documented in 

NRC Inspection Manual Chapter (IMC) 2800, “Materials 

Inspection Program.” Associated with IMC 2800 are 

specific inspection procedures that are used to verify 

that licensees are effectively implementing NRC 

requirements. 

3.1.3 Enforcement 

Another important aspect of NRC’s oversight in this 

area is NRC’s enforcement program. The NRC 

assesses the significance of licensee violations of NRC 

requirements by assigning a severity level to all 

violations. The assessment considers: 

• actual safety or security consequences, 

• potential safety or security consequences, 

• potential for impacting the NRC's ability to 

perform its regulatory function, and 

• any willful aspects of the violation. 

Severity level designations reflect different degrees of 

significance and include Severity Levels I, II, III, and IV 

and minor violations. 

NRC INSPECTION 

PROGRAM 

All NRC materials licensees that 

possess radioactive material are 

inspected on a routine basis. 

Licensees that possess Category 1 

and 2 quantities of radioactive material 

are inspected to ensure compliance 

with 10 CFR Part 37 and other 

regulatory requirements. Inspection 

frequency for these licensees varies 

depending on the risk associated with 

the licensed materials and activities. 

 

Documents pertaining to the NRC’s 

Inspection Program are publicly 

available at: 

http://www.nrc.gov/reading-rm/doccollections/insp-manual/ 
6 

Severity Level I (SLI) violations are of the highest 

significance. SLI violations are those that resulted in, 

or could have resulted in, serious safety or security 

consequences. These violations involve, for 

example, the theft, diversion, or sabotage of a 

Category 1 quantity of radioactive material that 

results from the failure to establish or implement one 

or more regulatory requirements. 

Severity Level II (SLII) violations are those that 

resulted in or could have resulted in significant safety 

or security consequences; for example, the theft, 

diversion, or sabotage of a Category 2 quantity of 

radioactive material resulting from the failure to 

establish or implement one or more regulatory 

requirements. 

Severity Level III (SLIII) violations are those that 

resulted in or could have resulted in moderate safety 

or security consequences. 

Severity Level IV (SLIV) violations are those that are 

less serious, but are of more than minor concern, 

that resulted in no or relatively inappreciable 

potential safety or security consequences. 

Minor violations are those that are less significant 

than a SLIV violation. While such violations must be 

corrected, minor violations do not warrant 

enforcement action and are not normally 

documented in inspection reports. 

3.2 Overview of NRC Source Security 

Program Features 

The oversight of licensees that possess Category 1 

and 2 quantities of radioactive material is facilitated by two critical elements of the NRC’s source 

security program: (1) an ongoing assessment of the threat level to determine if changes are 

needed to the measures enacted for protecting radiological materials; and (2) a comprehensive 

suite of data management tools that enable the tracking of Category 1 and 2 licenses and the 

sources held under those licenses, and enable the license verification function to ensure the 

validity of material transfers. 

3.2.1 Threat Assessment 

The NRC continually monitors intelligence information to keep abreast of foreign and domestic 

events and to maintain a real-time awareness of the capabilities of potential adversaries. The 

NRC uses this information, and other sources, to determine the physical protection 

requirements for source security regulations. 

The NRC’s Office of Nuclear Security and Incident Response conducts daily official liaison with 

the Intelligence and Law Enforcement Communities on intelligence and threat matters. The 

NRC works closely with the intelligence community, and other Federal agencies, as appropriate, 

NRC ENFORCEMENT 

PROGRAM 

The NRC applies the guidance in the 

NRC Enforcement Policy when 

assessing the significance of licensee 

violations. The Policy includes 

examples of violations for different 

licensee types and severity levels. 

 

The NRC's Enforcement Policy is 

publicly available at: 

http://www.nrc.gov/aboutnrc/regulatory/enforcement/enforcepol.html.
7 

to ensure the timely transfer of relevant intelligence information. The NRC staff performs 

prompt assessment of security threats to licensees and regulated activities. 

As part of the Task Force, the NRC collaborates with its Federal and State partners to perform a 

periodic review of the types and quantities of radioactive materials in use. In accordance with 

the Task Force charter, the Task Force periodically reevaluates the list of radioactive sources 

that warrant enhanced security and protection to assess its adequacy in light of the evolving 

threat environment, and consistent with current National consequences of concern (e.g., prompt 

fatalities, land contamination, economic consequences). In preparation for the 2014 Task Force 

report, the Task Force reviewed information from the intelligence community regarding the 

current threat of terrorist organizations using radioactive sources or other radioactive materials 

against the U.S., along with isotope production and usage information, in order to determine 

whether changes to the radioactive sources list or threshold levels were needed. The Task 

Force is not aware of any specific threat against a 

specific target. In addition, the global use of 

radioactive sources has remained stable both in 

isotopes and quantity such that the Task Force 

determined that additional radionuclides or changes in 

thresholds for the existing list is not justified at this 

time. 

3.2.2 Information Technology Applications 

The Integrated Source Management Portfolio (ISMP) 

is a suite of information technology tools that supports 

the NRC radioactive material security program and 

related radioactive materials licensing and tracking 

activities. The key systems that comprise the ISMP 

include the National Source Tracking System (NSTS), 

the Web-Based Licensing (WBL) System and the 

License Verification System (LVS). The integration of 

these systems ensures the security and control of 

radioactive material by tracking information related to 

the NRC and Agreement State licensees. 

National Source Tracking System. NSTS is a 

secure, national system that tracks and accounts for 

Category 1 and Category 2 sources licensed by the 

NRC or Agreement States from the time they are 

manufactured or imported through the time of their 

disposal, decay, or export. The NSTS pre-existed the 

relatively recent Part 37 rulemaking. Requirements to 

report information into the NSTS are governed by NRC 

regulations in Part 20. The NSTS tracks and accounts 

for over 77,000 Category 1 and 2 sources held by 

1,400 NRC and Agreement State licensees and 

processes 7,500 – 10,000 transactions per month. 

This tracking system enhances the agency's ability to 

detect and act upon inventory discrepancies, respond 

to emergencies, and verify the legitimate use and 

transfer of sources. It has also helped the NRC to 

CATEGORY 1 AND 2 

SOURCE TRANSACTIONS 

The National Source Tracking System 

tracks transactions associated with 

more than 77,000 Category 1 and 2 

sources nationwide. Of those 

transactions, manufacture (23%), 

transfer (38%), and receipt (27%) are 

the most common transactions, 

followed by export (11%) and import 

and disposal (<1% each). 

Of the total sources, roughly 90% are 

cobalt-60; 5% are cesium-137, and 4% 

are iridium-192. 
8 

locate and ensure the safety of radioactive materials after natural events such as hurricanes 

and tornadoes. 

Category 1 and 2 sources are evenly represented in NSTS, with Category 1 sources comprising 

50 percent of the sources in the database and Category 2 comprising the remaining 50 percent. 

The isotopes within the system are less evenly distributed, with the majority of the sources in 

the system being cobalt-60. Used in industrial irradiators, panoramic irradiators, and external 

beam radiation therapy units, cobalt-60 sources are replaced approximately every 5 years. 

While the cobalt-60 sources are the largest inventory item in NSTS, the majority of transactions 

occur with iridium-192. This isotope is used in radiography, and the source decays below 

usefulness in about 3 months. The iridium-192 source transactions, which include manufacture, 

transfer, and receipt, make up 97 percent of the transactions reported. 

Web-Based Licensing System. WBL is a repository of all Category 1 and 2 radioactive 

materials licenses nationwide. The system is used solely by regulatory bodies. In addition to its 

use by the NRC, it is available for use by Agreement State regulators to enable them to use the 

same licensing and information platform as the NRC. License information stored in WBL, when 

paired with data from NSTS, serves as the basis for license verification.

License Verification System. LVS is an integrated service designed to provide access to 

Category 1 and Category 2 license information maintained by the NRC and Agreement States. 

LVS is used by licensees to confirm that a license is valid and accurate and that a licensee is 

authorized to acquire quantities and types of radioactive materials being requested. LVS 

performs automated verification checks using data that resides in WBL and NSTS in order to 

verify that Category 1 and 2 possession limits are not exceeded by licensees. 

4.0 NRC Assessment of 10 CFR Part 37 

The NRC performed an assessment of the effectiveness of the requirements in Part 37 as 

mandated by the Appropriations Act. This assessment evaluated events reported by licensees 

in accordance with the rule as well as the results of inspections conducted to verify NRC 

licensee compliance with Part 37 requirements. In the interest of performing a complete and 

thorough analysis, the NRC expanded the assessment activities to include a more 

comprehensive evaluation of additional topical areas such as trustworthiness and reliability, 

stakeholder feedback on the rule, and observations made by independent consultants regarding 

the effectiveness of Part 37. The NRC also expanded the assessment to evaluate events that 

occurred while the Orders were in place to identify any potential opportunities to enhance the 

rule to ensure its suitability to address loss and theft events. 

4.1 Inspection Results 

From March 2014 to March 2016, the NRC performed 255 inspections to confirm NRC licensee 

compliance with the requirements of Part 37. The majority of inspections, 184 or 72 percent, 

resulted in no violations. The remaining 71 inspections resulted in 189 specific violations issued 

to 61 licensees. Given that there are approximately 1,400 Agreement State and NRC licensees 

implementing Part 37, these inspections account for 17 percent of Category 1 and 2 licensees in 

the United States. 

The NRC staff closely tracked the results of the Part 37 inspections. Additionally, the staff 

tracked precedent setting violations and examples. To better analyze the clarity and 

effectiveness of the Part 37 requirements, general citations such as “10 CFR 37.3 – failure to 

comply with the requirements of Part 37” were not acceptable. The staff, including but not 

limited to, inspectors, security specialists and attorneys, discussed root cause of the violations 
9 

and agreed upon the appropriate regulatory citation(s). The staff conducted an in-depth 

analysis of the violations cited during inspections to determine if the issues demonstrated any 

problems with the regulation itself. Minor violations (i.e., less than SLIV) were not evaluated as 

part of the assessment because, consistent with the NRC Enforcement Policy, these violations 

constitute minor safety or security concerns that, although they must be corrected, generally do 

not warrant enforcement action or documentation in inspection reports. 

Violations were 

cited against 

requirements 

contained in each 

of the four 

Subparts of 

Part 37: Subparts 

A, B, C, and D. 

Subpart A, 

“General 

Provisions,” 

provides definitions 

for key terms, 

requirements for 

transmitting 

communications 

and reports 

concerning the 

regulations, and 

requirements for 

submitting 

exemptions to the 

rule. Subpart B, 

“Background 

Investigations and 

Access 

Authorization 

Programs,” 

contains requirements for implementation of an access authorization program. Subpart C, 

“Physical Protection Requirements During Use,” includes requirements for establishment, 

implementation, and maintenance of a security program. Finally, Subpart D, “Physical 

Protection in Transit,” provides requirements for transferring a Category 1 or 2 quantity of 

radioactive material. 

Of the 189 total violations cited against the rule during the first 2 years of implementation for 

NRC licensees, 187 of the violations were cited against Subparts B and C, one violation was 

cited against Subpart A and one against Subpart D. In cases where a licensee received a 

notice of violation that identified multiple examples (i.e., a SLIV “problem” with four separate 

violations listed), each violation was counted individually. 

NRC ENFORCEMENT ACTIONS: 10 CFR PART 37 OVERSIGHT (MARCH 2014-MARCH 2016)

Severity Level III (SLIII) violations are those that resulted in or could have resulted 

in moderate safety or security consequences. 

Severity Level IV (SLIV) violations are those that are less serious, but are of more 

than minor concern, that resulted in no or relatively inappreciable potential safety or 

security consequences. 
10 

Subpart A – General Provisions 

One violation of Subpart A was identified 

for a licensee failing to revise the security 

plan required by Part 73 to include 

activities related to Category 2 radioactive 

material stored in the same room as the 

licensee’s research and test reactor. 

Subpart B – Background Investigations 

and Access Control Program 

A total of 75 violations of Subpart B of 

Part 37 were cited. In the majority of 

cases where licensees failed to meet the 

requirements in Subpart B, licensees did 

not fully document how their security 

program complied with Part 37. For 

example, licensees failed to provide 

Reviewing Official oath and affirmations to 

the NRC, complete informed consent 

forms, or have a documented basis for 

trustworthiness and reliability 

determinations. The documentation was 

suitable for compliance with postSeptember 11 security Orders, but was not 

updated or revised to reflect the 

requirements of Part 37. The most 

prevalent violations of Subpart B, failure to 

meet the requirements in 10 CFR 37.23, 

“Access Authorization Program 

Requirements,” accounted for 21 percent 

of all violations cited against the rule. 

Generally, these violations represented 

programmatic issues such as the lack of 

procedures for and documentation 

associated with the access authorization 

program. 

In some cases where a failure to 

implement certain provisions of Subpart B 

was cited, licensees performed incomplete 

evaluations of individuals with access to 

security information. Specifically, 

licensees did not properly consider that 

information technology staff could 

potentially access protected security 

information. 

VIOLATIONS BY SUBPART: 10 CFR PART 37 OVERSIGHT (MARCH 2014-MARCH 2016)

During the first two years of NRC licensee implementation 

of Part 37, a total of 189 violations were cited against the 

provisions of the rule during inspection activities. More 

than half of these violations resulted from licensees’ failure 

to appropriately transition from the requirements of the 

Orders to those in the rule. 
11 

Subpart C – Physical Protection Requirements During Use 

A total of 112 violations of Subpart C were cited. In the majority of violations where licensees 

failed to meet the requirements in Subpart C, as was the case for violations against Subpart B, 

licensees did not fully document how their security program complied with Part 37. For 

example, licensees failed to fully develop and provide training to staff that have security 

responsibilities, document annual coordination with the LLEA, ensure detection and 

communication in the event of loss of primary power source, adequately document and 

implement the annual maintenance and testing program, adequately implement and document 

their annual security program review, report suspicious activities within the required timeframe, 

and report unsuccessful coordination with LLEA. For many inspections citing violations, it was 

noted that the licensee had continued to implement the Orders as opposed to implementing the 

requirements in Part 37, which included more planning, procedural, and process elements than 

the previously-in-force Orders. Violations cited against Section 37.43 of Subpart C, “General 

Security Program Requirements,” represented the most frequent violation of 10 CFR Part 37. 

These violations represented 33 percent of the total violations issued in the first 2 years of the 

Part 37 rule implementation. 

Subpart D – Physical Protection in Transit 

The NRC inspectors identified one violation of Subpart D, resulting from a licensee’s failure to 

perform license verification prior to the transfer of a Category 2 quantity of radioactive material. 

The violation resulted from a failure to comply with 10 CFR 37.31(b), which requires licensees to 

verify with the NRC's LVS or the license issuing authority that the transferee's license authorizes 

the receipt of the type, form, and quantity of radioactive material to be transferred. 

Discussion 

In analyzing the violations of Part 37, the NRC assessed the significance of violations as well as 

their prevalence. No SLI or SLII violations were cited, which indicates that there were no 

violations with actual safety or security consequences. The majority of the violations (90 

percent) were SLIV violations, which indicates that the violations resulted in no or relatively 

inappreciable potential safety or security consequences. The remaining 10 percent of violations 

were SLIII, which are those that resulted in or could have resulted in moderate safety or security 

consequences. 

Of the SLIII violations, about 74 percent were related to a violation of Subpart C. The remaining 

SLIII violations were of Subpart B. No SLIII violations of Subparts A or D were cited. As noted 

previously, when multiple violations were cited in a single notice of violation (i.e., when multiple 

violations that share commonality are identified and grouped as a “problem”), the specific 

violations were counted individually in order to ensure appropriate assessment of noncompliances. In fact, ten of the total 19 SLIII violations were cited in a notice of violation issued 

to one individual licensee. Consequently, of the 61 licensees that received violations during the 

evaluation period, only six of the licensees received SLIII violations. The SLIII violations were 

consistent with the overall trends in violations of the rule in that many were the result of 

inadequate understanding of certain rule requirements by licensees. 

Examples of the SLIII violations included failure to continuously monitor and detect without 

delay all unauthorized entries into the licensee’s security zone when staff members, who were 

relied upon to provide the continuous monitoring and detection via direct visual surveillance, 

were not working due to observance of holidays; failure to develop a written security plan and 

procedures to document how the security plan will be met; failure to have two independent 
12 

physical controls that form tangible barriers against unauthorized removal when a mobile device 

is not under direct control and constant surveillance (mobile device was stored overnight next 

to, but not inside, a storage vault); failure to provide an alternative data transmission and 

processing capability, in the event of a loss of the primary means of data transmission, as a 

result of only being able to communicate with an offsite central alarm system via a single phone 

line; and failure to coordinate with LLEA annually. 

None of the SLIII violations were cited as a result of actual safety or security consequences (i.e., 

theft of Category 1 or 2 radioactive material). Rather, the violations were indicative of licensee 

failures to adequately restrict access to or provide security for Category 1 or 2 radioactive 

material such that moderate safety or security consequences could have resulted had the 

violations been combined with circumstances such as adversarial intent. 

The majority of the violations of the rule were cited against Subparts B and C and shared a 

common theme; they resulted from a lack of transition to the requirements of Part 37 from the 

previously-in-force Orders. In these cases, the licensees had documentation and physical 

security measures in place that were suitable for compliance with the Orders but did not update 

or change documentation to reflect the requirements of the new regulation. This generally 

resulted in two distinct violations against Subpart B and C. Common terms used in inspection 

reports included that licensees: “misunderstood,” “didn’t fully understand,” “didn’t consider fully,” 

“displayed a lack of thoroughness,” or “had an incomplete knowledge and understanding,” of the 

Part 37 requirements. 

While some of the violations resulted from a failure to follow requirements that the staff 

determined to be clear and readily understood (e.g., failure to properly secure a source); a 

significant number of the violations resulted from a lack of understanding of the requirements, or 

from a lack of development of the program infrastructure (e.g., plans and policies, annual 

program reviews) that is required under the Part 37 rule, but had not been required by the 

Orders. 

Only one violation of Subpart A was cited and only one violation of Subpart D was cited. A low 

incidence of violations of Subpart A is consistent with the nature of the section. Subpart A 

provides general provisions for the rule, including the scope, definitions, and exemptions. As 

such, failures to comply with Subpart A should be limited to instances of inadequate 

implementation of the exemptions allowed by 10 CFR 37.11, which is the portion of the rule that 

was cited in the one violation identified in Subpart A. 

The low number of violations (one) of Subpart D for the protection of materials in transit could 

be because the majority of large manufacturer and distribution companies that consistently ship 

Category 1 and 2 radioactive materials are licensed by Agreement States. This assessment 

only looked at NRC licensees. Additionally, for licensees that transport their own sources, the 

security requirements for transportation are largely the same as they had been under the Orders 

or that exist for compliance with safety requirements, so the requirements are well-understood. 

Overall, the two most frequent violations (including SLIII and SLIV) of the rule were violations 

related to procedures. There were 26 violations of 10 CFR 37.23(f), which requires that access 

authorization program requirements of Subpart B be documented in procedures. Similarly, 

there were 25 violations of 10 CFR 37.43(b)(1), which requires that security program 

requirements in Subpart C be documented in procedures.

In total, more than 25 percent of all cited violations were failures to adequately document 

program requirements in procedures. Licensees were not required to have documented 
13 

security programs under the Orders; however, under Part 37, licensees have the responsibility 

to develop, document, and implement security plans and access authorization programs that 

satisfy specific requirements set forth by the rule. The analysis of inspection results from early 

implementation of the rule demonstrates that licensees have had issues implementing new 

planning, procedure, and documentation requirements. Conversely, for protective measures 

that remained unchanged between the Orders and the rule, licensees demonstrated a high level 

of compliance. 

Inspection Results Assessment Outcome 

The NRC determined that, although substantial guidance has been issued on the new rule and 

the differences between the Orders and the rule, further outreach is necessary. When paired 

with the March 2016 deadline for Agreement State implementation of Part 37-compatible 

requirements, it is evident that communication to licensees regarding the inspection experience 

obtained and resources available to licensees to aid in the transition from the Orders to the rule 

is warranted. The NRC plans to prepare a generic communication to ensure licensee 

awareness of inspection experience in the implementation of Part 37 as well as the availability 

of reference material such as the crosswalk between the Orders and Part 37 requirements. 

4.2 Events 

Reporting theft or loss of radioactive material is an important requirement for NRC and 

Agreement State licensees to ensure the regulatory authority is notified as soon as possible of 

events regarding radioactive material. These reporting requirements are found under 

10 CFR Part 20, Subpart M3. For Category 1 and 2 radioactive materials, Part 37 imposes 

reporting requirements4 beyond those of Part 20 related to attempted or actual theft, sabotage, 

or diversion of radioactive material. The NRC collects the information related to these event 

reports within the Nuclear Material Events Database (NMED). The staff searched NMED 

specifically for reports of theft of Category 1 and 2 radioactive materials. In order to facilitate 

this analysis, the staff expanded the scope of the review to include Agreement States and to 

include the entire time period during which the Orders were in effect5. Since May 2006 (when 

the security Orders went into effect), there have been no thefts of Category 1 radioactive 

materials and six thefts of Category 2 radioactive materials. Prior to the security Orders, from 

1990 to April 2006, there had been 20 reported thefts of a total of 33 sources/devices6 that 

ranged in quantity (e.g., Category 2 or Category 3). Three of the events involved multiple 

sources/devices, with zero thefts totaling up to a Category 1 quantity of radioactive material. 

 

3 10 CFR 20, Subpart M, requires licensees to report to the NRC immediately when the occurrence of any lost, stolen, 

or missing licensed material becomes known to the licensee. Category 1 and 2 materials are included in the 

quantities of licensed material subject to this reporting requirement.

4 10 CFR 37.57 requires licensees to (1) immediately notify the LLEA after determining that an unauthorized entry 

resulted in an actual or attempted theft, sabotage, or diversion of a Category 1 or Category 2 quantity of radioactive 

material and (2) assess any suspicious activity related to possible theft, sabotage, or diversion of Category 1 or 

Category 2 quantities of radioactive material and notify the LLEA as appropriate. For events or activities in which the 

LLEA is notified, licensees are required to make a report to the NRC within 4 hours. 5 The Orders were issued in November 14, 2005, and licensees were given 6 months to come into compliance with 

the requirements. 10 CFR Part 37 was issued in March 2013. The NRC licensees had until March 2014 to come into 

compliance, and Agreement States had until March of 2016 to implement compatible, legally binding requirements for 

their licensees.

6 Reports from 1990-2006 used different conventions for reporting the theft of radioactive material. For example, a 

report might state that 6 radiography cameras were stolen totaling X Ci of iridium-192. Such reports did not specify 

the individual activity of the sources, so correlating the theft event to specific Categories of material (e.g., Category 2 

or Category 3) for individual sources was not possible.
14 

The six reported thefts of Category 2 radioactive 

materials since 2005 were of radiography cameras 

containing iridium-192. The events all occurred in 

Agreement States, with the two 2015 events occurring 

in an Agreement State that had not yet implemented 

Part 37-compatible requirements. Of the six reported 

thefts, five of the sources were recovered and 

returned to the licensee. The device that was not 

recovered quickly decayed below the threshold 

deemed risk-significant. Following an event, the NRC 

or Agreement State authority conducts an 

assessment to determine the appropriate response, 

and, for instances of loss or theft of risk-significant 

radioactive materials, typically conducts a reactive 

inspection. The events listed above were investigated 

by the licensee’s regulator at the time of occurrence, 

and appropriate enforcement actions were taken 

against the licensees. The staff reviewed the 

circumstances of these cases against the safety and 

security requirements in the Code of Federal 

Regulations to evaluate whether there are any “gaps” 

in the requirements that would have allowed these 

events to occur had the licensees been in compliance 

with Part 37 at the time of the event and found none. 

On the contrary, the staff found a number of 

requirements that would have prevented such events 

from occurring. Note that 10 CFR Part 20, Part 30, 

and other related requirements have been, and 

continue to be, in effect for the safe and secure use of 

these materials, and that the requirements of Part 37 

provide an enhanced level of protection.

Besides the theft of material, other security-related events must be reported to the NRC, such 

as suspicious activities and any attempts at unauthorized access. Although some of the 

reported incidents contain details that demonstrate the ability of security measures to deter or 

hamper efforts to gain access to sources, the majority describe more general concerns, such as 

people taking pictures of facilities or unknown persons requesting tours of facilities. The NRC 

evaluates each report to ensure that appropriate law enforcement and intelligence agencies are 

notified, and to use combined agency resources and systems to track trends in activities that 

could lead to actual malicious activities against the United States. There has been no overall 

increase in the number or types of suspicious activities tracked by the NRC that are related to 

the use of radioactive materials at such facilities. The staff actively monitors suspicious 

activities to ensure adequate protection of these materials in a fluid threat environment. 

Other events that can impact public health and safety but do not involve criminal or suspicious 

activity are also reported and tracked. This additional reporting includes incidents where 

sources have fallen off/out of a truck, been left at a job site, left in a vehicle, lost by the shipping 

company, or otherwise unattended. Although a common perception may be that sources being 

left unattended occurs frequently, given the number of radioactive sources in use and in transit 

in the United States, these incidents are actually not very common. Not including the six actual 

INDUSTRIAL 

RADIOGRAPHY 

Industrial radiography is a common 

application of Category 2 quantities of 

radioactive material. Of the events that 

are required to be reported, radiography 

events constitute the majority of the 

events reported due to the mobile nature 

of the work which often leads to human 

error in controlling the materials while in 

use, storage, and transit. 

Top: 

Radiography Camera 

Bottom: 

Truck used for 

industrial 

radiography field 

work
15 

thefts discussed above, since 

implementation of the Orders, there were 

29 incidents reported that involved 

Category 1 and 2 quantities of 

radioactive material. Some of these 

reports were of instances where devices 

were inadvertently left unattended for 

some period of time (e.g., left at a jobsite, 

or left unlocked in storage) but were 

retrieved. More commonly though, they 

resulted from shipments that were not 

received when anticipated but were 

ultimately located and delivered correctly. 

This was the case in 13 of the 29 events. 

Of this population of events, there were 

only two that involved Category 1 

quantities of radioactive materials, both 

of which were shipping errors; the 

remaining events were associated with 

Category 2 quantities of radioactive 

material. None of these events were 

security-related. 

Events Assessment Outcome 

In all the events, it is clear that 

carelessness or human error contributed 

to the thefts and that, had the existing 

regulatory requirements in effect for the 

storage and control of licensed material 

been followed, the thefts could have 

been prevented. 

The analysis of events from 1990 until 

implementation of the Orders showed, 

similarly, that a robust regulatory 

infrastructure has existed for decades to 

ensure the protection and security of 

sources, and that thefts are generally 

infrequent in nature and occur as the 

result of crimes of opportunity enabled by 

inadequate implementation of existing 

requirements. The augmenting of 

specific security practices, as required by 

Part 37, provides an enhanced level of 

protection against theft of the sources by 

minimizing the opportunity for theft to 

occur. 

CASE STUDY: 

PROTECTION AGAINST THEFT 

Of the six instances of theft of risk-significant radioactive 

material that occurred from 2006-2016, five were the 

result of theft of a source that was stored on a truck, or 

theft of a truck that had a source onboard. The 

following regulatory requirements in Title 10 of the Code 

of Federal Regulations currently apply to protection of 

this material and could have prevented the thefts, had 

they been implemented: 

• 20.1801, Licensee required to secure licensed 

material from unauthorized removal. 

• 20.1802, Licensee required to control and maintain 

constant surveillance of licensed material not in 

storage. 

• 34.23, Licensees required to lock radiography 

devices, storage containers, and source changers 

when not under direct surveillance. 

• 37.43, Licensees required to establish a security 

plan and implementing procedures for its specific 

operations. Licensees required to ensure that 

individuals implementing the security program 

understand and are capable of implementing such 

duties and provide refresher training annually. 

• 37.49, Licensees required to establish and 

maintain the ability to detect without delay 

unauthorized entries into security zones. Licensee 

required to establish a means to immediately 

detect unauthorized removal of Category 1 or 2 

material from the security zone. 

• 37.53, Licensees are required, with limited 

exceptions, to immobilize the vehicle when devices 

are not under direct control and surveillance by 

licensee.

The analysis demonstrates that the current regulatory 

infrastructure provided by Parts 20, 34, and 37 for these 

materials is robust, and if followed, capable of protecting 

against theft. 
16 

4.3 Additional Assessment Activities 

In order to support the analysis of inspection outcomes and events and to provide a holistic and 

integrated assessment of the effectiveness of Part 37, the NRC performed a comprehensive 

evaluation of the rule and associated guidance. Referred to as the “program review,” this effort 

involved not only the evaluation of events, incidents, and inspection results, but also analyzed 

the specific concerns raised in the 2012 and 2014 GAO audits; GAO-12-925 “Nuclear 

Nonproliferation: Additional Actions Needed to Improve Security of Radiological Sources at U.S. 

Medical Facilities,” and GAO-14-293, “Nuclear Nonproliferation: Additional Actions Needed to 

Increase the Security of U.S. Industrial Radiological Sources.” As a result, the program review 

also considered the following topics: 

• Trustworthiness and reliability program; 

• Collocation of well logging sources; 

• Enhanced tracking and accounting of radioactive sources; and 

• Training for NRC and Agreement State inspectors. 

In addition to evaluating specific facets of the Part 37 security program requirements and 

infrastructure described above, the staff conducted a comparison of Part 37 radioactive material 

security requirements and associated guidance with other international recommendations and 

material security programs. This consisted of reviewing national material security programs that 

are comparable to Part 37 regulatory requirements and identifying any differences in the 

security programs used by other nations and the International Atomic Energy Agency. 

Observations in which security requirements and practices differed between the United States 

and other nations were evaluated and considered by the NRC staff as part of the program 

review. 

The program review also entailed extensive stakeholder outreach. Specifically, the staff 

conducted numerous outreach activities to seek feedback from stakeholders regarding the 

clarity and effectiveness of the rule and associated guidance documents. These activities 

included issuance of a Federal Register notice requesting public comments on a series of 

questions regarding the effectiveness and clarity of the rule and guidance as well as holding 

four webinars and a public meeting at NRC Headquarters to gather feedback on stakeholder 

experiences, perspectives, and challenge areas. Each public comment received was 

considered by the NRC staff to determine if follow-up action, such as considering changes to 

the rule or guidance, was warranted. 

Finally, the program review sought to incorporate feedback regarding the rule through the 

analysis of observations and recommendations made by external Independent Assessment 

Consultants (IACs). In October 2014, the NRC Office of Nuclear Material Safety and 

Safeguards appointed three consultants with specific expertise to assist in the program review. 

Each consultant had extensive knowledge of radioactive material safety and security and 

evaluated a specific topic associated with the program review. The IACs assessed: 

• Clarity of the requirements set forth in Part 37, including implementing guidance and 

best practices documents; 

• Completeness and thoroughness of staff’s efforts to assess the clarity of the Part 37 rule 

and guidance; and 
17 

• The NRC’s rollout of Part 37, considering training and guidance for inspection, 

communication to stakeholders (licensees and Agreement States), and Agreement State 

rollout of compatible requirements. 

The extensive nature of the program review enabled the NRC to obtain implementation 

information as well as stakeholder feedback related to the rule, which helped to inform the 

overall conclusions regarding the rule’s effectiveness. As described below, the analysis of 

inspection experience, when paired with the other program review activities, identified numerous 

enhancements that could improve the clarity of the rule and associated guidance and, 

subsequently, result in a more robust national program for the security of Category 1 and 2 

radioactive materials. 

The program review activities resulted in the analysis of over 200 observations and 

recommendations, including recommendations made by the IACs; comments and questions 

provided by stakeholders; results from GAO reports; and observations identified by NRC staff 

during review of the rule, guidance, and inspection experience. Based on the program review, 

the NRC determined that the requirements of Part 37 are effective in preventing the theft or 

diversion of risk-significant quantities of radioactive materials. The NRC also concluded that 

potential rule clarifications and guidance initiatives could help to enhance the clarity and 

effectiveness of the rule, ensure better understanding of security expectations, and allow for 

more complete and adequate implementation. Highlights from the analysis of these issues are 

described below: 

• Challenges in the rollout of Part 37 were noted by the IACs, further emphasizing the 

need for additional outreach beyond that already provided by the NRC during the 

transition process to ensure licensee understanding of the requirements. 

• Significant differences in views among stakeholders were heard during the analysis and 

discussion of reinvestigation periodicity for trustworthiness and reliability determinations. 

The staff ultimately recommended retaining a 10-year periodicity while conducting 

further evaluation of potential strategies for insider mitigation, such as requiring selfreporting of legal actions and periodic behavioral observation of individuals to identify 

potential behaviors adverse to the trustworthiness and reliability determination in 

between the reinvestigations. 

• Assessment of the potential need to revise the definition of “aggregation” resulted in 

recommendations to revise the pre-licensing activities performed by the NRC for well 

logging licensees that are capable of aggregating above a Category 2 quantity of 

radioactive material to ensure a thorough evaluation of their strategies for controlling 

radioactive material. 

• Stakeholder feedback showed that there was confusion over certain security terminology 

in the rule that will require a thorough analysis and consideration and subsequent review 

in guidance to ensure clarity and consistency in use and application. 

• Consideration of adding disqualifying criteria to the rule for making trustworthiness and 

reliability determinations was an item of interest for stakeholders, IACs, GAO, and the 

NRC, that generated a multitude of diverse perspectives. The NRC determined that 

further evaluation of the subject would be needed in order to adequately analyze the 

results of Temporary Instruction (TI) 2800/042, “Evaluation of Trustworthiness and 

Reliability Determinations,” which was completed in November 2016. The NRC will 
18 

make a decision regarding disqualifying criteria after analyzing the results from TI 

2800/042. 

• The assessment of NRC requirements against international guidance and standards, as 

well as the IACs’ review, identified differences between U.S. standards and 

requirements of other countries. Substantial changes were not recommended regarding 

areas such as inclusion of Category 3 material under the provisions of 10 CFR Part 37, 

because there has been no change in use, availability, or threat directed toward 

Category 3 material. 

• Public feedback and other program review analyses indicated a need for guidance to 

address provisions for performing background investigations of foreign nationals; 

expectations for licensees for coordination with LLEA and what to do if coordination fails; 

reporting requirements when a licensee’s security force is also the LLEA; sharing of 

trustworthiness and reliability information among licensees; reporting of Category 1 

shipments to the NRC and/or Agreement State; what constitutes an adequate barrier; 

and implementation of Part 37 requirements for reactors in different phases of operation 

and decommissioning. It also identified the need to consider rulemaking to clarify if 

certain information in the license should be protected information under Part 37 and to 

make administrative changes to clarify portions of the rule and ensure internal 

consistency. 

• Inspection experience and public feedback indicated a need for guidance to address 

need-to-know and trustworthiness and reliability determination requirements for certain 

individuals who have access to protected information as a corollary to their job functions, 

such as information technology personnel and security service providers. 

 

5.0 Conclusion 

The analysis of events and inspection results, combined with the additional assessment 

activities performed during the program review, demonstrated that Part 37 provides a strong 

regulatory framework to ensure the security of Category 1 and 2 radioactive materials. 

The requirements of Part 37 have increased the security of risk-significant radioactive materials 

and have heightened licensee awareness of the need to protect these materials and be vigilant 

in monitoring and controlling them. Provisions such as background investigations assure that 

individuals are thoroughly assessed for trustworthiness and reliability prior to gaining access to 

materials. The development of security plans and coordination with LLEA provide readiness to 

respond to actual or potential events and individuals’ awareness of the need to be alert for 

suspicious activity. Finally, stringent requirements for monitoring the materials when in use, 

storage, or transport and controlling access to the materials restricts the potential for loss, theft, 

or diversion and subsequent malicious use. 

Part 37 incorporated over a decade of lessons learned by NRC and the Agreement States in 

implementing enhanced security controls provided in the Orders, and built upon those initial 

requirements to ensure that licensees implement a robust security program for the protection of 

Category 1 and 2 radioactive materials. Although the NRC intends to pursue specific outreach 

actions to communicate relevant information to stakeholders, enhance the clarity of 

implementing guidance, and even consider rulemaking in limited areas where the regulations 

could be strengthened or administratively clarified, the overall assessment of Part 37 

determined that the regulation itself is effective in achieving its objective: “provide reasonable 
19 

assurance of the security of Category 1 or Category 2 quantities of radioactive material by 

protecting these materials from theft or diversion.” 
20 

Appendix A: Acronyms and Abbreviations

CFR Code of Federal Regulations 

Ci Curie 

DHS Department of Homeland Security 

FBI Federal Bureau of Investigation 

FDA Food and Drug Administration 

GAO Government Accountability Office 

IACs Independent Assessment Consultants 

IAEA International Atomic Energy Agency 

IMC Inspection Manual Chapter 

ISMP Integrated Source Management Portfolio 

LLEA Local Law Enforcement Agency 

LVS License Verification System 

NMED Nuclear Material Events Database 

NRC Nuclear Regulatory Commission 

NSTS National Source Tracking System 

SL Severity Level 

Task Force Radiation Source Protection and Security Task Force 

TI Temporary Instruction 

WBL Web-based Licensing