Recommendation: The Chairman of the Nuclear Regulatory Commission should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 14)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of NRC should update the agency's policies to require (1) an organization-wide cybersecurity risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 50)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided information, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of NRC should establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. (Recommendation 52)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC concurred with this recommendation. As of January 2020, we had not received information pertaining to this recommendation. Once the commission has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Chairman of the Nuclear Regulatory Commission should take action to meet the data center optimization metric targets established under DCOI by OMB. (Recommendation 30)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: The Nuclear Regulatory Commission (NRC) is taking action to implement our recommendation. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the agency established new data center optimization targets. The agency subsequently reported meeting its targets for the virtualization, advanced energy metering, and server utilization metrics. However, given the short time to evaluate implementation efforts between when OMB released the updated policy in June 2019 and the end of fiscal year 2019, we will continue to monitor NRC's efforts to implement this recommendation through fiscal year 2020.

Recommendation: The Chairman of NRC should direct NRC staff to consider socioeconomic consequences and fatalities from evacuations in the criteria for determining what security measures should be required for radioactive materials that could be used in an RDD. (Recommendation 1)

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: NRC disagreed with this recommendation, and NRC did not provide us with documentation of any actions it plans to take to implement this recommendation. NRC maintains that the current regulatory requirements provide for the safe and secure use of all radioactive materials, regardless of category. We disagree with NRC's assessment. We continue to believe that by implementing our recommendation NRC would have better assurance that it was considering more likely and more significant consequences of an RDD when establishing its security requirements for this material. We encourage NRC to take action to implement this recommendation.

Recommendation: The Chairman of NRC should require additional security measures for high-risk quantities of certain category 3 radioactive material, and assess whether other category 3 materials should also be safeguarded with additional security measures. (Recommendation 2)

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: NRC neither explicitly agreed nor disagreed with this recommendation, but stated that it would consider our recommendation as part of a working group the agency has established. The working group provided a staff analysis on these issues to the Commission in August 2017, but NRC has not updated this analysis taking into account the new information we provided in our April 2019 report. We continue to believe that implementing our recommendation would provide greater assurance that NRC's requirements are sufficient to help ensure all high-risk radioactive material are protected from theft and use in an RDD. We encourage NRC to take action to implement this recommendation.

Recommendation: The Chairman of NRC should require all licensees to implement additional security measures when they have multiple quantities of category 3 americium-241 at a single facility that in total reach a category 1 or 2 quantity of material. (Recommendation 3)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC disagreed with this recommendation. NRC maintains that the issue of aggregation of radioactive material has already been considered and NRC has taken or is in the process of taking actions to clarify relevant guidance and procedures. We disagree with NRC's assessment. We believe that by implementing our recommendation NRC would have better assurance that licensees are not storing multiple quantities of category 3 americium-241 at a single facility that in total reach a category 1 or 2 quantity of material.

Recommendation: The Chairman of the Nuclear Regulatory Commission should document in the agency's tribal consultation policy how agency officials are to communicate with tribes about how tribal input from consultation was considered in agency decisions on infrastructure projects. (Recommendation 19)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Nuclear Regulatory Commission should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the five areas we identified. (Recommendation 23)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: NRC disagreed with our recommendation but generally agreed with our findings, and the agency had departmental policies to address three of the 15 responsibilities identified in the report. In March 2020, the agency stated it was identifying the appropriate agency policy to amend to address the remaining responsibility gaps. It anticipated that it would complete those updates by the end of the second quarter of FY 2020. We will continue to monitor the steps the agency takes to address this requirement.

Recommendation: The Chief Financial Officer of NRC should formally communicate to all licensees that supplemental billing information--including biweekly reports and monthly status reports on contractor charges--is available and how to request it. Formal communication that would reach all licensees could include adding information to their quarterly invoices. (Recommendation 1)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: According to officials, NRC plans to provide licensees with access to biweekly reports in the summer 2020, with an enhancement to the eBilling system expected in May 2020 and communicating to licensees about the availability of the information in July 2020. Additionally, NRC developed a form for licensees to request additional information on contractor charges on their bill and notified licensees that they may request additional information on contractor charges by submitting this form to NRC.

Recommendation: In developing the project plan for electronic billing, the Chief Financial Officer of NRC should include steps to assess the results of implementing electronic billing, which includes comparing the actual performance to intended outcomes. (Recommendation 5)

Agency: Nuclear Regulatory Commission
Status: Open

Comments: According to NRC, about 10 percent of licensees are currently participating in eBilling. We requested information on how NRC plans to assess the results of eBilling. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve NRC's ability to strategically manage the size and composition of its workforce and respond to changes in the nuclear industry, the Chairman of the Nuclear Regulatory Commission should set agencywide goals, which could be ranges, for overall workforce size and skills composition that extend beyond the 2-year budget cycle.

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: NRC generally agreed with this recommendation. In July 2017, NRC started a three-office pilot of an Enhanced Strategic Workforce Planning process to better integrate workload projection, skills identification, and human capital management, among other areas. NRC completed its enhanced strategic workforce planning pilot and now forecasts its workload on a 5-year time frame. However, as of May 2020, NRC officials said they do not plan to set agencywide goals for the workforce size and skills composition beyond the 2-year budget cycle.

Recommendation: To improve the awareness of how risk-significant radioactive sources are transported within the United States and to better determine whether Nuclear Regulatory Commission (NRC) is meeting its goal of providing reasonable assurance for preventing the theft or diversion of these dangerous materials, the Chairman of NRC should take actions to collect information from licensees on the number of shipments and mode of transport for such sources--for example, by identifying the extent to which an existing NRC database (e.g., the National Source Tracking System) may be used to capture this information.

Agency: Nuclear Regulatory Commission
Status: Open

Comments: In its February 26, 2018 report to Congress on actions NRC has taken in response to GAO recommendations, NRC continued to disagree with the recommendation to expand its existing data collection requirements or to transition such information from its existing NRC databases to the NSTS. NRC stated that, as required by 10 CFR Part 37, "Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material," the NRC currently collects the number of shipments and mode of transport for domestic transfers, and the import and export of Category 1 quantities of radioactive material. Additionally, under the provisions of 10 CFR Part 110, "Export and Import of Nuclear Material," the NRC stated that it collects the number of shipments and mode of transport for the import and export of shipments containing Category 2 or higher quantities of radioactive material. The NRC stated that it is the agency's position that the current information collected provides the NRC with an understanding of the potential modes of transport for Category 1 and 2 quantities of radioactive material and existing regulatory requirements provide robust protection for all such modes. The NRC stated that it does not consider the proposed additional information collection activity to be of sufficient safety or security benefit to justify the associated regulatory actions it would require. In August 2019, and again in August 2020, the NRC reaffirmed its disagreement with this recommendation and that it did not intend to take action to implement it. Despite its disagreement with this recommendation, we will continue to monitor whether NRC takes any actions that would result in addressing the concern GAO raised.

Recommendation: Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should take the steps needed to include category 3 sources in the National Source Tracking System and add agreement state category 3 licenses to the Web-based Licensing System as quickly as reasonably possible.

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: In October 2016, NRC issued a Staff Requirements Memorandum (SRM) "Proposed Staff Re-Evaluation of Category 3 Source Accountability," (SRM-COMJMB-16-0001) and directed NRC staff to take specific actions to evaluate whether it is necessary to revise NRC regulations or processes governing source protection and accountability for category 3 sources. Among other things, this re-evaluation was expected to consider GAO's recommendations. In August 2017, NRC staff completed its analysis and provided recommendations to the NRC Commissioners. (Most of this analysis is available on NRC's website.) In its analysis, the NRC staff recommended not including category 3 sources in the National Source Tracking System. They also recommended not adding agreement state category 3 licenses to the Web-based Licensing System. As of January 2020, the NRC Commissioners have yet to take action on the staff analysis.

Recommendation: Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should at least until such time that category 3 licenses can be verified using the License Verification System, require that transferors of category 3 quantities of radioactive materials confirm the validity of a would-be purchaser's radioactive materials license with the appropriate regulatory authority before transferring any category 3 quantities of licensed materials.

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: In October 2016, NRC issued a Staff Requirements Memorandum (SRM) "Proposed Staff Re-Evaluation of Category 3 Source Accountability," (SRM-COMJMB-16-0001) and directed NRC staff to take specific actions to evaluate whether it is necessary to revise NRC regulations or processes governing source protection and accountability for category 3 sources. Among other things, this re-evaluation was expected to consider GAO's recommendations. In August 2017, NRC staff completed its analysis and provided recommendations to the NRC Commissioners. (Most of this analysis is available on NRC's website.) In its analysis, the NRC staff recommended not requiring transferors of category 3 quantities of radiological material to confirm the validity of licenses prior to transferring any category 3 quantities of these materials. As of January 2020, the NRC Commissioners have yet to take action on the staff analysis.

Recommendation: Because some quantities of radioactive materials are potentially dangerous to human health if not properly handled, NRC should take action to better track and secure these materials and verify the legitimacy of the licenses for those who seek to possess them. Specifically, the NRC should, as part of the ongoing efforts of NRC working groups meeting to develop enhancements to the prelicensing requirements for category 3 licenses, consider requiring that an on-site security review be conducted for all unknown applicants of category 3 licenses to verify that each applicant is prepared to implement the required security measures before taking possession of licensed radioactive materials.

Agency: Nuclear Regulatory Commission
Status: Open

Comments: In October 2016, NRC issued a Staff Requirements Memorandum (SRM) "Proposed Staff Re-Evaluation of Category 3 Source Accountability," (SRM-COMJMB-16-0001) and directed NRC staff to take specific actions to evaluate whether it is necessary to revise NRC regulations or processes governing source protection and accountability for category 3 sources. Among other things, this re-evaluation will consider GAO's recommendations. In August 2017, NRC staff completed its analysis and provided recommendations to the NRC Commissioners. (Most of this analysis is available on NRC's website.) In its analysis, the NRC staff recommended requiring all safety and security equipment to be in place before granting a license to a previously unknown entity. This requirement would apply to all unknown entities applying for a radioactive material license regardless of the quantity of licensed material requested. If NRC took this action, it would fully address this recommendation. As of January 2020, the NRC Commissioners have yet to take action on the staff analysis.

Recommendation: To improve the reliability of its cost estimates, as NRC revises its cost estimating procedures, the NRC Chairman should ensure that the agency aligns the procedures with relevant cost estimating best practices identified in the GAO Cost Estimating and Assessment Guide and ensure that future cost estimates are prepared in accordance with relevant cost estimating best practices.

Agency: Nuclear Regulatory Commission
Status: Open
Priority recommendation

Comments: In August 2019, NRC staff reported that the Commission had directed them to revise the guidance and resubmit it to the Commission by January 2020. In February 2020, the NRC staff submitted the revised guidance to the Commission. NRC staff said that following Commission review and approval, they will publish the guidance. We will review the cost-benefit guidance when it is released and determine if it responds to this recommendation.

Recommendation: To ensure the effective management of software licenses, the Chairman of the Nuclear Regulatory Commission should provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management.

Agency: Nuclear Regulatory Commission
Status: Open

Comments: In March 2019, the Nuclear Regulatory Commission reported that the agency's IT asset management program requires training and communication, as appropriate for all key personnel. The agency also reported that on September 19, 2018, personnel associated with software asset management attended relevant training and will also participate in software training is currently being developed by the Office of Management and Budget, the Federal Acquisition Institute and the Defense Acquisition University. We will follow up with the agency to obtain supporting documents and continue to monitor its progress in implementing this recommendation.