Performance Audit of the U.S. Nuclear Regulatory Commission's Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2024 Region III: Naperville, Illinois

The OIG contracted with Sikich CPA LLC to conduct the Performance Audit of the NRC’s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2024 Region III: Naperville, Illinois. The objective was to assess the effectiveness of the information security policies, procedures, and practices of the NRC Region III facility. The findings and conclusions presented in this report are the responsibility of Sikich. The OIG’s responsibility is to provide oversight of the contractor’s work in accordance with generally accepted government auditing standards.
The agency’s staff indicated that they had no formal comments for inclusion in this report.
For the period March 2024 through November 2024, Sikich found that although the NRC generally implemented effective information security policies, procedures, and practices for Region III, the agency’s implementation of a subset of selected controls was not fully effective. There are weaknesses in Region III’s information security program and practices. As a result, one recommendation was made to assist Region III in strengthening its information security program.