SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
The IAEA defines nuclear security culture as: "The assembly of characteristics, attitudes and behaviors of individuals, organizations, and institutions which serves as a means to support and enhance nuclear security." This quote serves as the introduction for several slides giving an overview of the nuclear security culture.
Security culture plays a critical role in determining the effectiveness of an organization's security performance, making its significance impossible to overemphasize. It encompasses the collective values, shared perceptions, and habitual actions embraced by all individuals within a nuclear organization—from leadership to frontline staff. When the entire workforce recognizes the reality of potential threats, accepts that security is a shared duty, and integrates security-minded behavior into everyday routines, it fosters an environment where strong security practices are the norm. In such a setting, everyone can take pride and feel reassured in being part of an organization where a strong security culture is deeply embedded. Security culture is based on the broader concept of organizational culture. All organizations—whether families, social clubs, religious institutions, businesses, non-governmental organizations, or governments—possess an underlying culture shaped by core values and beliefs. These values and beliefs influence attitudes and drive behavior throughout the organization. While multiple factors contribute to the development of a strong security culture, leadership plays a particularly pivotal role. In organizations where security culture is well-established, leaders go beyond rhetoric; they demonstrate a genuine commitment to security through their actions. They implement policies and procedures that actively engage all employees, foster open dialogue around security concerns, and encourage teamwork in resolving issues. Furthermore, they reward proactive behavior and ensure that corrective actions are taken promptly. Regular assessments of the organization's security culture allow such leaders to gauge its effectiveness and take strategic steps to strengthen it when necessary. This paper leverages practical, real-world experience to guide leadership and senior management within nuclear organizations through the foundational steps of cultivating a robust, organization-wide culture of nuclear security. It emphasizes the critical importance of early leadership engagement in shaping this culture and outlines a comprehensive approach that includes strategic, tactical, and operational measures. Additionally, it explores methods for fostering a unified vision across all levels of the organization to ensure alignment, commitment, and continuous improvement in nuclear security practices.
We examine the following topics: Nuclear and Radiological Security Culture; Threats and consequences ; The Human Factor; Legal and Regulatory Basis for Security Culture; Security Culture basic concepts; Systematic SC program; Enhancing SC; and, Situational Awareness. We will discuss these aspects and conduct exercises to apply them
This paper explores the development of a Cyber Security Culture that deploys the appropriate technological and Human Performance tools using the key tenets of INPO's Nuclear Safety Culture program as a basis. (authors)
The focus area of this set of slides is on human factors as well as cultural obstacles related to security.
Pacific Northwest National Laboratory (PNNL) has engaged industry to “go beyond compliance” for over a decade in controlling and securing their supply chains to ensure their goods are not diverted to nuclear weapons programs. This work has focused on dual-use industries that manufacture products that can be used in both commercial applications and in the development of a nuclear weapon. The team encourages industry to self-regulate to reduce proliferation risks. As part of that work, PNNL interviewed numerous companies about their compliance practices to understand their business and to build awareness around best practices to ensure security of goods, technology, and information along their supply chains. From conducting this work, PNNL identified indicators that a company can adopt as part of its commitment to nonproliferation ideals with a focus on supply chain security.
For the past decade, a team at the Pacific Northwest National Laboratory (PNNL) has engaged industry to “go beyond compliance” in controlling and securing their supply chains to ensure their goods are not diverted to nuclear weapons programs. This work has focused on dual-use industries that manufacture products that can be used in both commercial applications and in the development of a nuclear weapon. The team encourages industry to self-regulate to reduce proliferation risks. As part of that work, PNNL interviewed numerous companies about their compliance practices in order to understand their business and to build awareness around best practices to ensure security of goods and information along their supply chains. As a result, PNNL has identified seven indicators that a company can adopt as part of their commitment to nonproliferation ideals.
Abstract not provided.
Explore the source record for details and available documents.
This presentation will introduce participants to key mental models on how to think about and understand safety and the organizational attributes that support it from three of the leading voices in the discipline – David Marx, Dr. Erik Hollnagel and Dr. Todd Conklin – and from there we ask the simple question of “how can we apply this to cybersecurity?” Opportunities, similarities, and differences from the history of accomplishment applying human and organizational performance principles to safety and reliability can be collectively leveraged to the meet the challenge of cybersecurity for OT/ICS/cyber-physical systems. This is the same intent as the "Cybersecurity Culture" principle of Cyber-Informed Engineering (CIE).
The nuclear industry recognizes the difficulties involved in developing effective managerial and leadership skills in a highly technical and proficient workforce such as that found in nuclear facilities. Implementing an insider threat mitigation program (ITMP) within the nuclear industry is a complex and ongoing process that demands a comprehensive understanding of human behavior, an organization’s security culture, and rigorous regulatory requirements yet also accounts for facility characteristics, physical security, material flow, and activities involving nuclear material. Given the high-consequence nature of research reactor operations, even minor lapses can lead to safety, security, and reputational risks. An effective ITMP requires a defense-in-depth approach that incorporates behavioral analysis, robust vetting procedures, continuous monitoring, and cross-disciplinary coordination. It must also promote a culture of vigilance and accountability at all levels up to and including executive leadership but be flexible enough to adapt to evolving global threats and technological advances. Insider threat mitigation is not a one-time effort but rather a sustained commitment to excellence in safety and security. Establishing a culture in which personnel proactively report incidents and issues that could affect nuclear safety and security is vital to maintaining a safe and secure operational environment. This document was developed to guide senior management and research reactor organizations in creating comprehensive programs to effectively manage and mitigate insider threat behaviors and actions. It focuses on the key pillars of an effective ITMP, including the national legal framework, security culture, preventive and protective measures, cyber security, and performance evaluation. By using a systematic approach during implementation, facilities can foster environments conducive to insider threat detection and support long-term program sustainability. The document also provides strategies for improving communication across all levels of an organization, helping to eliminate barriers that hinder the development of robust ITMPs and enhance overall security culture. In today’s organizations, the concept of leveraging safety and security culture lessons to facilitate knowledge transfer is rapidly evolving to expedite insider threat management and security culture improvements. This document outlines the rationale for evaluating an ITMP based on national customs, culture, and stakeholders. The elements are all germane to reliability and trustworthiness and relate to security concerns that states may encounter. The document focuses not only on individual perceptions regarding security issues and capability building but also on team building and how to resolve concerns. The implementers of a facility’s ITMP may zero in on indicators of insider threats within their enterprise. This material will benefit organizations when it is applied using a systematic and structured approach as demonstrated throughout the document.
The secure transportation of high-consequence materials, including nuclear and radiological assets, is a critical global priority in the face of escalating terrorism, security threats, and violent protests targeting these operations. Effective surveillance detection—the ability to identify, assess, and respond to potential threats across a continuum of scenarios—is paramount in addressing these challenges. This paper outlines a phased, multi-tiered training program designed to strengthen the surveillance detection capabilities of organizations responsible for nuclear material transport. The proposed training program adopts a progressive approach, gradually increasing in technical complexity to provide participants with comprehensive knowledge and tools for implementing robust security strategies. It targets a wide spectrum of stakeholders, including competent authorities, regulators, inspectors, shippers, carriers, law enforcement, and emergency response personnel, equipping them to plan, evaluate, and safeguard nuclear material transportation effectively. Each phase of the program emphasizes distinct elements of the surveillance detection continuum and transport security, focusing on critical topics such as threat identification, adversary task timelines, protective methodologies, and attack mitigation strategies. The training framework is anchored in technical exchanges and scenario-driven courses that reflect real-world complexities and challenges. By addressing the surveillance detection continuum comprehensively—from early threat assessment to active countermeasures—the program reinforces global efforts to secure nuclear assets. It aligns with international security objectives and fosters a strong security culture within participating organizations, ensuring personnel are prepared to counter potential threats and maintain the safe, secure movement of these materials. Ultimately, this initiative aims to enhance preparedness, security, and response capabilities, supporting the global mission to safeguard high-consequence materials against evolving threats.
Many domestic and international nuclear facilities have processes that require personnel to work on some type of shift. Shift work has many different schedules such as night, morning, swing, and rotating shift. Some common shifts are DuPont, Pitman, and Panama. There are many psychological and physiological impacts to a person working shifts. These impacts can affect work performance, safety, and security within an organization. A well-established nuclear organization relies on a strong security culture that implements a trustworthiness or reliability program. The IAEA defines this type of program as individuals meeting the highest standards of reliability, trustworthiness, and physical and mental suitability. Psychological and physiological impacts that apply to a Trustworthiness Program are reliability (an individual’s ability to adhere to security and safety rules and regulations) and physical and mental suitability. If shift work isn’t properly implemented in Facility Operations, then several issues or human factors can arise. An employee that suffers from a poorly designed shift, gets overworked, or doesn’t have the proper rest period implemented, may suffer from shift work disorder, acute fatigue, or cumulative fatigue. Introducing fatigue into Facility Operations can have severe consequences to security, safety, production, and cost. Another challenge of shiftwork within a facility is laziness and complacency. Creating an atmosphere where the employee is willing to admit fatigue to his or her supervisor is a challenge. It is up to the organization to do the needed research on shift work and to implement the best shift for their facility and personnel.
Problem Statement: There is a pervasive talent deficit in the cybersecurity industry that prevents employers from being able to fill their open positions efficiently. A holistic approach to security is required to ensure organizations have adequate prevention and response capabilities in case of a cyberattack. Specifically, industrial control systems (ICS’s) and their operational technology (OT) components have become a constant target for cyberattacks. Research Questions: It is proposed that the NICE Framework should be extended in the following areas: 1) Include guidance regarding the job roles and competencies for both IT and OT professionals. 2) Offer step-by-step solutions, based on the work role mappings from the NICE Framework, to increase cybersecurity through employee training and education. 3) Provide a streamlined, lifecycle approach to building a cybersecurity program. Contribution: The CYBER security – Competency Health and Maturity Progression (CYBER-CHAMP©) model provides a customized solution for businesses to understand their education gaps in organizational security and target areas for improvement. Rationale: The Framework for Improving Critical Infrastructure Cybersecurity v1.1 addresses ICS but does not offer a measurement of cybersecurity maturity or clear methods to ascertain an organization’s current risk profile. In Phases 1 and 5 of the model, measurements are provided to help an organization build their current and target risk profiles. The NICE framework provides a structure for planning an IT cybersecurity workforce, but the OT aspects of cybersecurity are only briefly discussed. The model uses Phases 2-3 to examine the competencies of an organization’s workforce, which includes both IT and OT roles. Current frameworks do not offer next steps to increase an organization’s cybersecurity. During Phase 4, employees’ roles are mapped to training, education, and/or certifications from common vendors. Investigative Approach: The model provides measurements and metrics for both an organization’s status and continual improvement. This improvement methodology includes guidance for creating an overall strategic plan for security improvement via products designed to increase an organization’s operational readiness through workforce competency health. Lessons Learned: Depending on who was participating, there were contradicting answers given in Phase 1 due to different security cultures in the organization. This revelation has influenced the steps listed in the User’s Guide, where Phase 1’s first recommended step is to assemble a team that champions the facilitation and implementation of the model in the organization. During Phase 2, the discovery was made that organizations may be missing roles that are necessary to perform critical cybersecurity functions. By understanding the functional roles and competencies needed, they can contract or hire cybersecurity help to fill these gaps. Implications: Using the model, organizations can discuss quantitative measures for improvement as a business case for advancing their security program. Future research can validate and extend the present theory and model to a variety of environments. It is of interest to investigate additional security roles and knowledge domains that are used to build standardized cybersecurity curriculum.
This study proposes a framework for evaluating cloud computing deployment in the electric sector, focusing on the digital transition of energy systems. It assesses the implications of cloud technology adoption, particularly in terms of security, operational resilience, and efficiency. The paper introduces a method for consequence-driven risk analysis, enabling utilities to prioritize and mitigate potential threats effectively. It also discusses the shared responsibility model in cloud computing, highlighting the need for collaborative security efforts. The research aims to provide utilities with a strategic assessment tool for cloud adoption, emphasizing the importance of security culture in enhancing cloud computing's role in critical infrastructure.
This study proposes a framework for evaluating cloud computing deployment in the electric sector, focusing on the digital transition of energy systems. It assesses the implications of cloud technology adoption, particularly in terms of security, operational resilience, and efficiency. The paper introduces a framework for consequence-driven applied risk analysis, enabling utilities to prioritize and mitigate potential threats effectively, and responsibly deploy cloud applications. It also discusses the shared responsibility model in cloud computing, highlighting the need for collaborative security efforts. The research aims to provide utilities with a strategic assessment tool for cloud adoption, emphasizing the importance of security culture in enhancing cloud computing's role in critical infrastructure.
A Human Reliability Program (HRP) is designed to protect national security as well as worker and public safety by continuously evaluating the reliability of those who have access to sensitive materials, facilities, and programs. Some elements of a site HRP include systematic (1) supervisory reviews, (2) medical and psychological assessments, (3) management evaluations, (4) personnel security reviews, and (4) training of HRP staff and critical positions. Over the years of implementing an HRP, the Department of Energy (DOE) has faced various challenges and overcome obstacles. During this 4-day activity, participants will examine programs that mitigate threats to nuclear security and the insider threat to include HRP, Nuclear Security Culture (NSC) Enhancement, and Employee Assistance Programs. The focus will be to develop an understanding of the need for a systematic HRP and to discuss challenges and best practices associated with mitigating the insider threat.