Inactive accounts for an online Nuclear Regulatory Commission system used for developing probabilistic risk assessments of nuclear plants outnumber active accounts, says a report from the NRC office of inspector general.

The report, dated Sept. 19, examined the software, the Systems Analysis Programs for Hands-on Integrated Reliability Evaluation. NRC rolled out version 8 of the system, more commonly known as SAPHIRE, in April 2010. The software itself meets operational capability and there is limited security risk to it, auditors say. SAPHIRE, which performs the math behind a nuclear plant risk assessment, is available in client and online versions.

But the NRC lacks formal polices or procedures for online SAPHIRE user account management, the audit says. Auditors say 313 user accounts exist as of June 2011, and the majority of them are inactive--that is, they haven't been accessed by the user for a year. Most user accounts are set up for NRC employees by the Idaho National Laboratory, which also creates user accounts for its employees. NASA, too, can create SAPHIRE user accounts.

"One inactive user claimed that he had not accessed the SAPHIRE website in approximately 10 years," the report says.

A senior NRC manager told auditors that creating formal policies and procedures for user account management hasn't been a priority, since there are a small number of people involved with managing SAPHIRE. Although auditors didn't uncover any instances of inappropriate access nonetheless "many users have maintained website access after it was no longer needed."

NRC officials, the report says, expressed general agreement with recommendations that including formalizing policy, but didn't provide a written response.

For more:  
- download the report, OIG-11-A-18 (.pdf)

Related Articles:
Nuclear Regulatory Commission may adopt a bring-your-own-device mobile strategy 
Nuclear plant operators to update evacuation time estimates
Nuclear waste management needs overhaul, says commission