Audit of the U.S. Nuclear Regulatory Commission's Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2023 Region I: King of Prussia, Pennsylvania

ADAMS Accession No: ML24295A041<br />
Agency Response Dated September 16, 2024: The NRC has implemented a process to validate that all new contractor personnel complete their initial security training requirements and acknowledgement of the rules of behavior within 20 business days of obtaining access to the NRC <br />
systems, and annually thereafter. The staff updated the change in timeline in NRC Management Directive 12.5, “NRC Cybersecurity Program.” In addition, the NRC will ensure the tracking of the completion of annual security awareness training and renewal of acknowledgement of the rules of behavior. This activity is monitored in the Talent Management System. Target Completion Date: The NRC recommends closure of <br />
this item. <br />
OIG Analysis: The OIG reviewed and verified that NRC management has implemented a process to validate that all new users completed their initial security training requirements and acknowledgement of rules of behavior within the defined timeframes that the NRC has established. This recommendation is now closed.

ADAMS Accession No: ML24295A041<br />
Agency Response Dated September 16, 2024: Region I has implemented a quarterly Division Action review process in the Division of Resource Management to conduct access reviews and remove unnecessary badged access to the secure areas. In addition, the NRC already has an effective process in place to conduct reviews and removal of unnecessary badged access at Headquarters, regional offices, and the Technical Training Center. Specifically, Management Directive 12.1, “NRC Facility Security Program,” dated April 22, 2024, describes the following: The NRC access control system is managed and maintained by DFS [the Division of Facilities and Security]. It is used to ensure that only authorized <br />
individuals are granted physical access. Access lists (a list of individuals with authorized access) are required for administratively controlled, limited access, and security-controlled areas and must be reviewed and approved by the room’s designated owner (i.e., the Access Reviewing Official) at least annually. The agency conducts an assessment of access with every badge renewal. Target Completion Date: The NRC recommends closure of this item. <br />
OIG Analysis: The OIG reviewed and verified that NRC management has defined and implemented a process for conducting reviews and removing unnecessary badged access for its Regions. This recommendation is now closed.