ML25209A087
| ML25209A087 | |
| Person / Time | |
|---|---|
| Issue date: | 08/13/2025 |
| From: | Mark King NRC/EDO |
| To: | Virkar H NRC/OIG |
| References | |
| OIG-NRC-25-A-09 | |
| Download: ML25209A087 (1) | |
Text
H. Virkar UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 MEMORANDUM TO:
Hruta Virkar Assistant Inspector General for Audits FROM:
Michael F. King Acting Executive Director for Operations
SUBJECT:
STATUS OF RECOMMENDATIONS: AUDIT OF U.S. NUCLEAR COMMISSIONS WEB-BASED LICENSING SYSTEM (OIG-NRC-25-A-09)
The purpose of this memorandum is to provide the U.S. Nuclear Regulatory Commissions (NRCs) response to the recommendations in the Office of the Inspector Generals (OIGs) audit report titled Audit of the U.S. Nuclear Regulatory Commissions Web-Based Licensing System (OIG-NRC-25-A-09). Below are the status updates and context for each recommendation, including target completion dates and points of contact.
If you have any questions or need additional information, please contact me or Ernesto Quinones, Sr. Project Manager, at 301-415-0271.
Status of Recommendations:
Recommendation 1.1 Update the inactivity control in the Nuclear Material FISMA Systems-system security plan to include references to the 30-minute deviation request and approval.
Status: Completed The inactivity timeout setting for the Nuclear Materials FISMA (NMFS) boundary was updated from 15 minutes to 30 minutes, consistent with Deviation 15-05, which was approved in 2016.
The NMFS system security plan (SSP) has been revised to reflect this change and now documents both the approved 30-minute timeout setting and the associated deviation approval process.
The NMFS is the parent system to the Integrated Source Management Portfolio (ISMP), which includes the Web-Based Licensing (WBL) System. The NMFS SSP includes the following statement: Please refer to the NMFS subsystems SSPs for this control implementation details.
Within the ISMP Subsystem Security Plan, the following is documented: WBL session lock is initiated after 30 minutes of inactivity. This session lock will remain in effect until the user re-establishes access using appropriate identification and authentication procedures. WBL has been granted Deviation 15-05 to deviate from the requirement of 15 minutes.
August 13, 2025 Signed by King, Michael on 08/13/25
H. Virkar 2
These updates address the recommendation in full and it is now considered complete.
Completion Date: March 26, 2025 Point of
Contact:
John Thomas, NMSS/DRMA Recommendation 1.2 Update the Web-Based Licensing System User Guides instructions on clearing the cache to access the system without closing the browser.
Status: Completed The WBL User Guide was revised to remove inaccurate instructions advising users to clear the browser cache following a session timeout. The updated guidance now correctly states that a full browser restart is required to regain access.
Completion Date: July 25, 2025 Point of
Contact:
Kim Lukes, NMSS/MSST Recommendation 2.1 Evaluate and update the Web-Based Licensing System to ensure users assigned to multiple roles may perform tasks associated with the highest access rights.
Status: Completed WBL role assignment procedures have been reviewed to ensure users assigned to multiple roles can perform all tasks associated with the highest level of access required for their responsibilities. In practice, the primary role is designated to reflect the highest level of access needed, and elevated roles are granted when additional functionality is required. The WBL Help Desk continues to promptly address role assignments, misconfigurations, and access-related issues to avoid disruptions in licensing activities. Based on these actions, this recommendation is considered complete.
Completion Date: March 31, 2025 Point of
Contact:
Nandini Sharma, NMSS/DRMA Recommendation 2.2 Update the Web-Based Licensing Systems user role descriptions to ensure users capabilities in the system are properly defined.
Status: Open
H. Virkar 3
The WBL team will review and refine all user role descriptions to ensure they accurately reflect current system functionality and align with users responsibilities.
Target Completion Date: December 31, 2025 Point of
Contact:
Nandini Sharma, NMSS/DRMA Recommendation 2.3 Develop and implement a process to periodically update user roles in the Web-Based Licensing System to ensure users may perform tasks commensurate with their assigned NRC responsibilities.
Status: Completed A process exists to update user roles in WBL when a need is identified. When users are unable to perform tasks due to insufficient access or role limitations, the WBL Help Desk either resolves the issue using existing roles or initiates a change request to revise or create roles, as needed.
Although WBL does not currently include proactive system-driven detection of access gaps, this reactive process ensures that users system roles are updated in response to changes in responsibilities or access needs. Based on the implementation and use of this process, staff consider this recommendation closed.
Completion Date: March 31, 2025 Point of
Contact:
Nandini Sharma, NMSS/DRMA Recommendation 3.1 Update the Web-Based Licensing System User Guide to incorporate guidance on how to use the new modules added to the WBL System and describe how to use new enhancements to the system.
Status: Open The WBL User Guide will be updated to include workflows and feature-specific instructions for newly added and enhanced system modules (e.g., STIMS/FFIMS, DUWP, GLTS, Export/Import). Points of contact (POCs) for each module will provide the input needed to ensure the guide is both comprehensive and accurate.
Target Completion Date: July 1, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 3.2 Establish a schedule to periodically review the Web-Based Licensing System User Guide and determine if it incorporates significant enhancements made on how to use the system.
Status: Open
H. Virkar 4
A recurring review schedule will be implemented for each module POC to ensure the WBL User Guide remains current with system enhancements. NMSS divisions and module POCs will be responsible for reviewing and updating the User Guide content on a scheduled basis. MSST will coordinate the collection of updates from NMSS divisions and OIP to support thorough and timely revisions.
Target Completion Date: January 2026 (recurring)
Point of
Contact:
Kim Lukes, NMSS/MSST Recommendation 4.1 Update the Web-Based Licensing System Change Control Procedure and related information resources to accurately reflect the current process and issue a memo to WBL users informing them of the updated process.
Status: Open An updated WBL Change Control Procedure is currently under development and will reflect the current process for managing system changes. Once finalized, the updated procedure will be shared with users and posted to the WBL SharePoint site. Users will be notified through periodic communications to ensure awareness of the updated process and other relevant information.
Target Completion Date: December 31, 2025 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 4.2 Clarify the role of a Web-Based Licensing System module point of contact and update the points of contact list for the Web-Based Licensing System Change Control Procedure.
Status: Open Module POCs have been identified, and their roles will be reflected in the WBL Change Control Procedure and WBL SharePoint site. Updated POC information will also be communicated to the relevant NMSS and Regional divisions.
Target Completion Date: December 31, 2025 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 5.1 Prioritize and fix any current features within the Web-Based Licensing System that are not operating correctly.
Status: Completed The WBL business and IT teams use a structured process to identify, track, and resolve reported defects. All issues, including formatting inconsistencies such as spacing in license
H. Virkar 5
templates and functional problems, are recorded in a centralized backlog and prioritized based on their business needs. Interim workarounds are provided when appropriate until permanent solutions can be implemented. This process ensures that system issues are addressed systematically and that WBL functionality continues to improve.
This recommendation is considered complete based on the ongoing use of this process and the resolution of identified issues to date.
Completion Date: March 31, 2025 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 6.1 Identify and automate the appropriate data entry areas within the Decommissioning, Uranium Recovery, and Waste Programs module to promote accurate, complete, and standardized data entry.
Status: Open Since March 2025, DUWP has been using the Reactor Program System to manage licensing and inspection activities. However, they still rely on WBL for managing docket information, billing, and accessing historical records. DUWP staff will review WBL as appropriate to identify any areas where data entry validations could improve accuracy, completeness, and consistency.
Target Completion Date: July 1, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 6.2 Update existing inspection data entry guidance to include how to document assist inspections and general license inspections.
Status: Open The inspection data entry guide will be updated to include instructions for documenting Assist inspections and General License inspections.
Target Completion Date: March 1, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 6.3 Review the existing guidance for each Web-Based Licensing System module and update it to reflect current data entry practices, as appropriate.
Status: Open
H. Virkar 6
Existing data entry guidance for each WBL module will be reviewed and updated, as appropriate, to reflect current data entry practices.
Target Completion Date: July 1, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 7.1 Identify and implement strategies that improve the search functionality of the Web-Based Licensing System.
Status: Open The primary issue affecting search functionality in WBL appears to be user unfamiliarity rather than functional limitations within the system. To address this, we plan to explore user support options such as quick-reference guides and/or targeted training to help users navigate and search more effectively before considering any changes to system functionality. For the GLTS module specifically, a user guide will be developed (see Recommendation 3.1), which will include clear, step-by-step instructions for using the search feature.
In addition, dashboards already provide streamlined access to commonly needed data through pre-built visuals and data export capabilities. These dashboards include license and inspection-related data to help users obtain the information they need without having to perform complex searches. As these dashboards continue to expand, they are expected to reduce the need for users to run independent queries within the system.
Target Completion Date: December 31, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST Recommendation 7.2 Update the Web-Based Licensing System to make the search functionality consistent across all the modules.
Status: Open The search functionality in WBL is consistent across all modules, including GLTS, with the exception that the GLTS module requires the use of the % symbol as a wildcard. This feature was originally requested during GLTS development. We will create a change request to remove the need for the % wildcard and prioritize other search enhancements as needed to improve the user experience.
Target Completion Date: December 31, 2026 Point of
Contact:
Ernesto Quinones, NMSS/MSST
ML25209A087 OFFICE NMSS/MSST NMSS/MSST NMSS/MSST NMSS/MSST OEDO/EDO NAME EQuinones SWyman DSilberfeld KBrock MKing DATE 7/28/25 7/28/25 7/28/25 7/28/25 8/ 13 /25