EVALUATION REPORT 

REDACTED VERSION 

Office of the Inspector General Information 

System Security Evaluation of Region III - 

Lisle, IL 

OIG-09-A-15 September 28, 2009 

All publicly available OIG reports are accessible through 

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/ 
 OFFICIAL USE ONLY 

. 

Office of the Inspector General 

Information System Security Evaluation of 

Region III – Lisle, IL 

Contract Number: GS-00F-0001N 

Delivery Order Number: 20291 

September 21, 2009 
 

 

EXECUTIVE SUMMARY 

BACKGROUND

The U.S. Nuclear Regulatory Commission (NRC) has four regional offices that conduct 

inspection, enforcement, investigation, licensing, and emergency response programs for 

nuclear reactors, fuel facilities, and materials licensees. The Region III office operates 

under the direction of a Regional Administrator and is located in Lisle, Illinois. The 

region covers a seven-State area, including six States with nuclear power plants. Region 

III also regulates all Federal facilities that hold materials licenses in all regions. In 

addition, Region III oversees materials licensees in Missouri, which is part of Region IV. 

On December 17, 2002, the President signed the E-Government Act of 2002, which 

included the Federal Information Security Management Act (FISMA) of 2002. FISMA 

outlines the information security management requirements for agencies, which include 

an annual independent evaluation of an agency’s information security program1

 and 

practices to determine their effectiveness. This evaluation must include testing the 

effectiveness of information security policies, procedures, and practices for a 

representative subset of the agency’s information systems. FISMA also requires 

assessment of compliance with FISMA requirements and related information security 

policies, procedures, standards, and guidelines. FISMA requires the annual evaluation to 

be performed by the agency’s Inspector General or by an independent external auditor. 

The NRC Office of the Inspector General (OIG) requested that the four NRC regional 

offices and the Technical Training Center (TTC) be included in the independent 

evaluation of the agency’s implementation of FISMA for fiscal year 2009. Information 

security policies, procedures, and practices at the regional offices and the TTC were last 

assessed in 2003 and 2006. This report describes evaluation findings for Region III. 

 

1

 For the purposes of FISMA, the agency uses the term “information system security program.” 
 

 

PURPOSE

The objectives of the information system security evaluation of Region III were to: 

 Evaluate the adequacy of NRC’s information security program and practices for 

NRC automated information systems as implemented at Region III. 

 Evaluate the effectiveness of agency information security control techniques as 

implemented at Region III. 

 Evaluate corrective actions planned and taken as a result of previous OIG 

evaluations. 

RESULTS IN BRIEF

Region III has made improvements in its implementation of NRC’s information system 

security program and practices for NRC automated information systems since the 

previous evaluations in 2003 and 2006. All corrective actions from the previous 

evaluations have been implemented. However, the information system security program 

and practices are not always consistent with the NRC’s automated information systems 

security program as defined in Management Directive (MD) and Handbook 12.5, NRC 

Automated Information Systems Security Program, other NRC policies, FISMA, and 

National Institute of Standards and Technology (NIST) guidance. While many of the 

Region III automated and manual security controls are generally effective, some security 

controls need improvement. Areas needing improvement included: continuity of 

operations and emergency planning, and configuration management. Specifics cannot be 

presented in this publicly released version of the report. 

RECOMMENDATIONS

This report makes recommendations to the Executive Director for Operations to improve 

NRC’s information system security program and implementation of FISMA at Region 

III.