ML25253A461
| ML25253A461 | |
| Person / Time | |
|---|---|
| Issue date: | 09/10/2025 |
| From: | Virkar H NRC/OIG/AIGA |
| To: | Mark King NRC/EDO |
| References | |
| OIG-NRC-25-A-09 | |
| Download: ML25253A461 (1) | |
Text
NRC Headquarters l 11555 Rockville Pike l Rockville, Maryland 20852 l 301.415.5930 nrcoig.oversight.gov MEMORANDUM DATE:
September 10, 2025 TO:
Michael F. King Acting Executive Director for Operations FROM:
Hruta Virkar, CPA /RA/
Assistant Inspector General for Audits & Evaluations
SUBJECT:
STATUS OF RECOMMENDATIONS: AUDIT OF THE U.S.
NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM (OIG-NRC-25-A-09)
REFERENCE:
EXECUTIVE DIRECTOR FOR OPERATIONS, MEMORANDUM DATED AUGUST 13, 2025 Attached is the Office of the Inspector Generals (OIG) analysis and status of recommendation as discussed in the agencys response dated August 13, 2025. Based on this response, recommendations 1.1, 1.2, and 2.3 are now closed. Recommendations 2.1, 2.2, 3.1, 3.2, 4.1, 4.2, 5.1, 6.1, 6.2, 6.3, 7.1, and 7.2 remain open and resolved. Please provide an updated status of the open, resolved recommendations by March 14, 2026.
If you have any questions or concerns, please call me at 301.415.1982 or Mike Blair, Team Leader, at 301.415.8399.
Attachment:
As stated cc: J. Martin, ADO D. Lewis, DADO E. Deeds, OEDO OIG Liaison Resource EDO ACS Distribution
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 2 Recommendation 1.1:
Update the inactivity control in the Nuclear Material FISMA Systems (NMFS) system security plan to include references to the 30-minute deviation request and approval.
Agency Response Dated August 13, 2025:
The inactivity timeout setting for the Nuclear Materials FISMA boundary was updated from 15 minutes to 30 minutes, consistent with Deviation 15-05, which was approved in 2016. The NMFS system security plan (SSP) has been revised to reflect this change and now documents both the approved 30-minute timeout setting and the associated deviation approval process.
The NMFS is the parent system to the Integrated Source Management Portfolio (ISMP), which includes the Web-Based Licensing (WBL) System. The NMFS SSP includes the following statement: Please refer to the NMFS subsystems SSPs for this control implementation details.
Within the ISMP Subsystem Security Plan, the following is documented: WBL session lock is initiated after 30 minutes of inactivity. This session lock will remain in effect until the user re-establishes access using appropriate identification and authentication procedures. WBL has been granted Deviation 15-05 to deviate from the requirement of 15 minutes.
These updates address the recommendation in full and it is now considered complete.
Completion Date: March 26, 2025 OIG Analysis:
The OIG reviewed the updated NMFS system security plan and the associated ISMP system security plan, and verified that they included references to the 30-minute deviation request and approval. Therefore, this recommendation is now closed.
Status:
Closed
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 3 Recommendation 1.2:
Update the Web-Based Licensing System User Guides instructions on clearing the cache to access the system without closing the browser.
Agency Response Dated August 13, 2025:
The WBL User Guide was revised to remove inaccurate instructions advising users to clear the browser cache following a session timeout. The updated guidance now correctly states that a full browser restart is required to regain access.
Completion Date: July 25, 2025 OIG Analysis:
The OIG reviewed the Web-Based Licensing System User Guide and verified that its instructions correctly stated how to regain access to the system. Therefore, this recommendation is now closed.
Status:
Closed
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 4 Recommendation 2.1:
Evaluate and update the Web-Based Licensing System to ensure users assigned to multiple roles may perform tasks associated with the highest access rights.
Agency Response Dated August 13, 2025:
WBL role assignment procedures have been reviewed to ensure users assigned to multiple roles can perform all tasks associated with the highest level of access required for their responsibilities. In practice, the primary role is designated to reflect the highest level of access needed, and elevated roles are granted when additional functionality is required.
The WBL Help Desk continues to promptly address role assignments, misconfigurations, and access-related issues to avoid disruptions in licensing activities. Based on these actions, this recommendation is considered complete.
Completion Date: March 31, 2025 OIG Analysis:
The OIG reviewed the ISMP Help Desk Standard Operating Procedures and acknowledged that they contain the process for updating user roles. The OIG will close the recommendation after verifying that the WBL has been reviewed or updated to prevent access restrictions for its user groups. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 5 Recommendation 2.2:
Update the Web-Based Licensing Systems user role descriptions to ensure users capabilities in the system are properly defined.
Agency Response Dated August 13, 2025:
The WBL team will review and refine all user role descriptions to ensure they accurately reflect current system functionality and align with users responsibilities.
Target Completion Date: December 31, 2025 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the user role descriptions are updated and properly defined in the WBL. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 6 Recommendation 2.3:
Develop and implement a process to periodically update user roles in the Web-Based Licensing System to ensure users may perform tasks commensurate with their assigned NRC responsibilities.
Agency Response Dated August 13, 2025:
A process exists to update user roles in WBL when a need is identified. When users are unable to perform tasks due to insufficient access or role limitations, the WBL Help Desk either resolves the issue using existing roles or initiates a change request to revise or create roles, as needed. Although WBL does not currently include proactive system-driven detection of access gaps, this reactive process ensures that users system roles are updated in response to changes in responsibilities or access needs. Based on the implementation and use of this process, staff consider this recommendation closed.
Completion Date: March 31, 2025 OIG Analysis:
The OIG reviewed the ISMP Help Desk Standard Operating Procedures and acknowledged that it contains the process for updating user roles. The OIG also acknowledged and verified that the agency utilizes a reactive process for updating users system roles so they may perform tasks commensurate with their assigned NRC responsibilities.
Therefore, this recommendation is now closed.
Status:
Closed
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 7 Recommendation 3.1:
Update the Web-Based Licensing System User Guide to incorporate guidance on how to use the new modules added to the WBL System, and describe how to use new enhancements to the system.
Agency Response Dated August 13, 2025:
The WBL User Guide will be updated to include workflows and feature-specific instructions for newly added and enhanced system modules (e.g., STIMS/FFIMS, DUWP, GLTS, Export/Import). Points of contact (POCs) for each module will provide the input needed to ensure the guide is both comprehensive and accurate.
Target Completion Date: July 1, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the WBL User Guide incorporates guidance on how to use the new modules added to the WBL System and describes how to use new enhancements to the system. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 8 Recommendation 3.2:
Establish a schedule to periodically review the Web-Based Licensing System User Guide and determine if it incorporates significant enhancements made on how to use the system.
Agency Response Dated August 13, 2025:
A recurring review schedule will be implemented for each module POC to ensure the WBL User Guide remains current with system enhancements. Office of Nuclear Material Safety and Safeguards (NMSS) divisions and module POCs will be responsible for reviewing and updating the User Guide content on a scheduled basis. The Division of Materials Safety, Security, State, and Tribal Programs will coordinate the collection of updates from NMSS divisions and the Office of International Programs to support thorough and timely revisions.
Target Completion Date: January 2026 (recurring)
OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the agency has established a schedule to periodically review the WBL System User Guide to determine if it incorporates significant enhancements on how to use the system. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 9 Recommendation 4.1:
Update the Web-Based Licensing System Change Control Procedure and related information resources to accurately reflect the current process and issue a memo to WBL users informing them of the updated process.
Agency Response Dated August 13, 2025:
An updated WBL Change Control Procedure is currently under development and will reflect the current process for managing system changes. Once finalized, the updated procedure will be shared with users and posted to the WBL SharePoint site. Users will be notified through periodic communications to ensure awareness of the updated process and other relevant information.
Target Completion Date: December 31, 2025 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the WBL System Change Control Procedure and related information sources have been updated to reflect the current process accurately and that WBL users have been informed of the updated process. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 10 Recommendation 4.2:
Clarify the role of a Web-Based Licensing System module point of contact and update the points of contact list for the Web-Based Licensing System Change Control Procedure.
Agency Response Dated August 13, 2025:
Module POCs have been identified, and their roles will be reflected in the WBL Change Control Procedure and WBL SharePoint site. Updated POC information will also be communicated to the relevant NMSS and Regional divisions.
Target Completion Date: December 31, 2025 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after clarifying the role of a Web-Based Licensing System module point of contact and verifying that the proper module points of contact have been updated and the information has been made available to WBL System users.
This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 11 Recommendation 5.1:
Prioritize and fix any current features within the Web-Based Licensing System that are not operating correctly.
Agency Response Dated August 13, 2025:
The WBL business and information technology (IT) teams use a structured process to identify, track, and resolve reported defects. All issues, including formatting inconsistencies such as spacing in license templates and functional problems, are recorded in a centralized backlog and prioritized based on their business needs. Interim workarounds are provided when appropriate until permanent solutions can be implemented. This process ensures that system issues are addressed systematically and that WBL functionality continues to improve.
This recommendation is considered complete based on the ongoing use of this process and the resolution of identified issues to date.
Completion Date: March 31, 2025 OIG Analysis:
The OIG acknowledges that the WBL System business and IT teams use a structured process to identify, track, and resolve reported defects, and those issues are prioritized and systematically addressed. However, the agencys response does not address identifying any existing issues that may not currently be in the centralized backlog. The OIG will close the recommendation after verifying that the agency has made an effort to identify any current features that are not operating correctly. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 12 Recommendation 6.1:
Identify and automate the appropriate data entry areas within the Decommissioning, Uranium Recovery, and Waste Programs (DUWP) module to promote accurate, complete, and standardized data entry.
Agency Response Dated August 13, 2025:
Since March 2025, DUWP has been using the Reactor Program System to manage licensing and inspection activities. However, they still rely on WBL for managing docket information, billing, and accessing historical records.
DUWP staff will review WBL as appropriate to identify any areas where data entry validations could improve accuracy, completeness, and consistency.
Target Completion Date: July 1, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the DUWP module has been updated to include automated data entry where appropriate, which would promote accurate, complete, and standardized data entry. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 13 Recommendation 6.2:
Update existing inspection data entry guidance to include how to document assist inspections and general license inspections.
Agency Response Dated August 13, 2025:
The inspection data entry guide will be updated to include instructions for documenting Assist inspections and General License inspections.
Target Completion Date: March 1, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the data entry guidance includes how to document assist inspections and general license inspections.
This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 14 Recommendation 6.3:
Review the existing guidance for each Web-Based Licensing System module and update it to reflect current data entry practices, as appropriate.
Agency Response Dated August 13, 2025:
Existing data entry guidance for each WBL module will be reviewed and updated, as appropriate, to reflect current data entry practices.
Target Completion Date: July 1, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the WBL System guidance for each module has been updated to reflect the current data entry practices. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 15 Recommendation 7.1:
Identify and implement strategies that improve the search functionality of the Web-Based Licensing System.
Agency Response Dated August 13, 2025:
The primary issue affecting search functionality in WBL appears to be user unfamiliarity rather than functional limitations within the system. To address this, we plan to explore user support options such as quick-reference guides and/or targeted training to help users navigate and search more effectively before considering any changes to system functionality. For the General License Tracking System (GLTS) module specifically, a user guide will be developed (see Recommendation 3.1), which will include clear, step-by-step instructions for using the search feature.
In addition, dashboards already provide streamlined access to commonly needed data through pre-built visuals and data export capabilities. These dashboards include license and inspection related data to help users obtain the information they need without having to perform complex searches. As these dashboards continue to expand, they are expected to reduce the need for users to run independent queries within the system.
Target Completion Date: December 31, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after verifying that the agency has identified and implemented strategies to improve the search functionality of the WBL System. This recommendation remains open and resolved.
Status:
Open: Resolved
Audit Report AUDIT OF THE U.S. NUCLEAR REGULATORY COMMISSIONS WEB-BASED LICENSING SYSTEM Status of Recommendations (OIG-NRC-25-A-09) 16 Recommendation 7.2:
Update the Web-Based Licensing System to make the search functionality consistent across all the modules.
Agency Response Dated August 13, 2025:
The search functionality in WBL is consistent across all modules, including GLTS, with the exception that the GLTS module requires the use of the % symbol as a wildcard. This feature was originally requested during GLTS development.
We will create a change request to remove the need for the %
wildcard and prioritize other search enhancements as needed to improve the user experience.
Target Completion Date: December 31, 2026 OIG Analysis:
The proposed actions meet the intent of the recommendation. The OIG will close the recommendation after the search functionality has been updated for consistent use across the WBL System. This recommendation remains open and resolved.
Status:
Open: Resolved