Part 37 Access Authorization and T&R

Physical barriers protect a high-activity radioactive source from an intruder, but an authorized insider with keys is an entirely different threat. 10 CFR Part 37 Subpart B addresses that threat with an access authorization program: before anyone gets unescorted access to a Category 1 or Category 2 quantity of radioactive material, they must pass a background investigation, be fingerprinted for an FBI criminal history check, and be judged trustworthy and reliable by a designated reviewing official.¹²³

Part 37 is easy to caricature as "the fingerprinting rule," but its logic is a genuine security program. Two facilities can have identical fences, locks, and alarms and still differ enormously in risk depending on who is allowed inside the barrier unaccompanied. Subpart B is how the NRC regulates that human dimension. This article explains what the access authorization program requires, who the reviewing official is, how the trustworthiness-and-reliability (T&R) determination works, and which materials trigger the rule in the first place. DRPS helps licensees build and document these programs through its radiation safety officer and radioactive material license support services across Florida, Maryland, Virginia, Washington DC, California, and Nevada.

Introduction

Part 37 — "Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material" — grew out of a post-9/11 recognition that the security of risk-significant radioactive sources needed a national baseline. It implements, in U.S. regulation, the risk-informed source categorization developed internationally by the IAEA, and it pairs physical-security requirements (Subpart C) with a personnel-security program (Subpart B).¹⁷⁸ The two halves are complementary: barriers and monitoring keep unauthorized people out, while the access authorization program decides who is allowed to be an authorized insider.

The access authorization program is not a formality. It reflects a specific insider-threat model: the person who could most easily divert or sabotage a source is often someone with legitimate, routine access. Subpart B is the mechanism that vets those people before they get keys, and re-vets the person who does the vetting.²³

Understanding Part 37 Subpart B is essential for any medical or research facility that operates a Cesium-137 irradiator, a Gamma Knife, or a Cobalt-60 teletherapy unit — and it is the natural companion to the physical-security side of source protection, which we cover in radioactive source security under Part 37.

Topic Explanation

What "access authorization" actually means

Under Part 37, individuals fall into two categories with respect to a Category 1 or 2 source: those with unescorted access (they may be alone with the material or its controlled area) and those with only escorted access (they must be continuously accompanied by someone with unescorted access). The entire purpose of the access authorization program is to decide who may be granted unescorted access.²

To grant unescorted access, the licensee must, before access is given:

Complete a background investigation of the individual, including fingerprinting and an FBI criminal history records check.³
Have the reviewing official evaluate all the collected information and determine that the individual is trustworthy and reliable.²

No unescorted access may be granted until that T&R determination is made. Individuals who are not (or not yet) authorized may still work near the material, but only under escort by an authorized person.²

The reviewing official: the linchpin of the program

The reviewing official is the single individual designated by the licensee who is authorized to make T&R determinations for unescorted access.² This concentration of authority is deliberate: it creates a clear, accountable decision-maker rather than diffusing the judgment across a committee.

Because the reviewing official holds that authority, the rule vets them especially carefully. The reviewing official must undergo their own background investigation and fingerprinting, and the licensee must certify under oath or affirmation that the reviewing official is trustworthy and reliable — and recertify that determination every 10 years.²³ In effect, the program watches the watcher.

Key Technical Principles

Which materials trigger Part 37: the category thresholds

Part 37 applies only to aggregated Category 1 and Category 2 quantities of radioactive material, defined in Appendix A. The categorization is risk-informed and derives from the IAEA's "D value" concept — the activity of a given radionuclide that, if uncontrolled, could cause severe deterministic health effects. Category 1 is set at 1,000 times the D value, and the Category 2 threshold (the point at which Part 37 begins to apply) is 10 times the D value.¹⁴⁷

Radionuclide	Category 1 threshold	Category 2 threshold	Typical medical/research device
Cesium-137	100 TBq (≈ 2,700 Ci)	1 TBq (≈ 27 Ci)	Self-shielded blood/research irradiator
Cobalt-60	30 TBq (≈ 810 Ci)	0.3 TBq (≈ 8.1 Ci)	Gamma Knife, Co-60 teletherapy

The terabecquerel values are the regulatory standard; the curie values are provided for convenience only.⁴ A modern self-shielded Cs-137 irradiator or the aggregate Co-60 loading of a Gamma Knife unit typically sits at or above these thresholds — a Gamma Knife's total Co-60 inventory is well above the Category 1 value — which is exactly why these devices bring their operators into Part 37. Many brachytherapy afterloader sources, by contrast, fall below the Category 2 threshold and are outside Part 37, though the reviewing official should confirm this against the current Appendix A values rather than assume it.

Worked example: the sum-of-fractions rule

A facility rarely has a single tidy source. When multiple sources or radionuclides are present in one location, Part 37 uses a sum-of-fractions test against the Category 2 thresholds. Let $A_{i}$ be the activity of radionuclide $i$ present at the location and $T_{i}$ be that radionuclide's Category 2 threshold. The location is subject to Part 37 if:

i \sum \frac{A _{i}}{T _{i}} \geq 1

Suppose a research building houses two Cs-137 sources: a self-shielded irradiator holding 0.7 TBq and a separate calibration/research source holding 0.4 TBq. Using the Cs-137 Category 2 threshold of 1 TBq:

\frac{0.7 TBq}{1 TBq} + \frac{0.4 TBq}{1 TBq} = 0.7 + 0.4 = 1.1 \geq 1

Because the sum of fractions is 1.1, the aggregated quantity meets the Category 2 threshold and the location falls under Part 37 — even though neither source alone reaches 1 TBq.⁴ This is the single most common way facilities are surprised by Part 37: individually modest sources that aggregate over the line. The same arithmetic works across radionuclides, using each nuclide's own threshold in the denominator.

The T&R determination is a judgment, not a score

A recurring misunderstanding is that trustworthiness and reliability is a pass/fail checklist. It is not. The reviewing official must evaluate all of the information collected — verified identity, the FBI criminal history results, employment and education history, and personal references — and reach an informed, documented judgment that the individual can be relied on to protect the material.² A single item does not automatically disqualify or qualify someone; the reviewing official weighs the whole picture. That is why the rule invests so heavily in choosing and certifying the right reviewing official.

Clinical Impact

Who this affects in a medical or research setting

In imaging-heavy practices, most nuclear-medicine radiopharmaceutical quantities stay well below Category 2, so day-to-day PET and SPECT operations usually fall outside Part 37. The rule bites where the sealed sources are large: blood and research irradiators (Cs-137), stereotactic radiosurgery units (Co-60 Gamma Knife), and legacy Co-60 teletherapy. For those programs, the access authorization requirement reaches a specific set of people — service engineers, radiation safety staff, facilities and security personnel, and anyone else who could be alone with the device or inside its controlled area.¹²

The operational consequence is that access is a managed list, not an assumption. A new biomedical engineer cannot simply be handed a key to the irradiator room; they must be investigated, fingerprinted, and cleared by the reviewing official first, or be escorted until they are. Building that workflow — and documenting it — is where many facilities need help, and it connects directly to the broader source-accountability requirements discussed in securing licensed material under 10 CFR 20.1801-1802.

Information protection

Because the program collects sensitive personal information and criminal history results, Part 37 also imposes protection requirements on that information — it must be handled to prevent unauthorized disclosure, with access limited to those who need it to carry out the program. A T&R program that leaks its own files has failed on its own terms.¹²

Practical Optimization Tips

Building a defensible access authorization program comes down to a few disciplined practices.

1. Get the applicability determination right first

Before anything else, document whether Part 37 even applies, using the sum-of-fractions rule and the current Appendix A thresholds. Re-run the determination whenever sources are added, replaced with a hotter source, or relocated.⁴

2. Designate and certify the reviewing official carefully

Choose a reviewing official with the standing and judgment to make T&R determinations, complete their background investigation and certification under oath, and calendar the 10-year recertification so it never lapses.²³

3. Never grant access ahead of the determination

Make "escort until cleared" the default for anyone whose investigation is incomplete. The rule is explicit that unescorted access cannot precede the T&R determination.²

4. Keep the background investigation scope correct

Cover at least the 7 years preceding the investigation, or since the individual's eighteenth birthday if shorter, and retain the documentation that supports each determination.³

5. Protect the program's information

Store criminal history and personal information with controlled access and a defined disclosure policy, and train the people who handle it.¹²

Common pitfalls to avoid

Assuming small sources are exempt. The sum-of-fractions rule can pull an aggregate over the Category 2 line even when no single source qualifies.
Letting the reviewing official recertification lapse. A lapsed reviewing official cannot make valid determinations.
Granting provisional access "just for today." Unescorted access before the T&R determination is a direct violation.
Treating T&R as a checklist. It is a documented judgment on the whole record.
Ignoring information protection. The program's own files are sensitive and must be safeguarded.

Regulatory Considerations

Part 37 is a federal security regulation, administered by the NRC and by Agreement States under compatible programs. The core framework:

10 CFR Part 37 — the security rule for Category 1 and 2 quantities, including Subpart B (background investigations and access authorization) and Appendix A (category thresholds).¹⁴
10 CFR 37.23 and 37.25 — the specific requirements for the access authorization program, the reviewing official, background investigations, and fingerprinting.²³
NUREG-2155 — the NRC's implementation guidance for Part 37, which explains how to build a compliant program.⁵
IAEA RS-G-1.9 and the Code of Conduct on the Safety and Security of Radioactive Sources — the international basis for the category thresholds Part 37 adopts.⁷⁸

Part 37 works alongside the medical-use and radiation-protection frameworks of 10 CFR Part 35 and 10 CFR Part 20, and alongside the general material-security requirements that apply even below the Part 37 thresholds.⁹¹⁰ For facilities tracking the highest-risk sealed sources, it also intersects the National Source Tracking System — see nationally tracked sources and the NSTS.

Jurisdiction matters. Of the states DRPS serves, Florida, Maryland, Virginia, California, Nevada, Pennsylvania, New York, and New Jersey are NRC Agreement States that administer compatible Part 37 programs, while Washington DC and Delaware are regulated directly by the NRC. A facility must confirm which authority holds its license and enforces its security program before relying on any applicability determination.

Frequently Asked Questions (FAQs)

What does 10 CFR Part 37 Subpart B require?

Subpart B requires an access authorization program before anyone is granted unescorted access to Category 1 or Category 2 quantities of radioactive material. It mandates a background investigation, fingerprinting and an FBI criminal history records check, and a determination by a designated reviewing official that the individual is trustworthy and reliable. Individuals who fail or decline the process may only have escorted access.

Who is the reviewing official under Part 37?

The reviewing official is the individual designated by the licensee who is the only person authorized to make trustworthiness and reliability determinations granting unescorted access to Category 1 or Category 2 material. The reviewing official must themselves undergo a background investigation and fingerprinting, be certified as trustworthy and reliable by the licensee, and be recertified every 10 years.

What is the scope of a Part 37 background investigation?

The background investigation must cover at least the 7 years preceding the investigation, or the period since the individual's eighteenth birthday, whichever is shorter. It includes verification of identity, fingerprinting and an FBI criminal history check, employment history, education, and personal references, evaluated together by the reviewing official.

Which radioactive materials trigger Part 37?

Part 37 applies to aggregated Category 1 and Category 2 quantities of radioactive material as defined in Appendix A. In medical and research settings these are typically Cesium-137 self-shielded irradiators and Cobalt-60 units such as Gamma Knife or teletherapy sources. Whether a location is covered is determined by comparing aggregated activity against the Appendix A thresholds using the sum-of-fractions rule.

Does fingerprinting go to the FBI?

Yes. Fingerprints collected under Part 37 are submitted through the NRC to the FBI for a criminal history records check. The fingerprints must be taken by a law enforcement agency, an authorized federal or state agency, or a commercial fingerprinting service authorized by a state, and the information is protected against unauthorized disclosure.

How is trustworthiness and reliability actually determined?

The reviewing official evaluates all the information collected — identity verification, the FBI criminal history results, employment and education history, and references — and makes an informed judgment that the individual can be relied upon to protect the material and not pose a security risk. It is a documented judgment, not a checklist score, and the reviewing official may not grant unescorted access until that determination is made.

What if a facility's sources are below the thresholds?

If aggregated activity stays below the Category 2 threshold under the sum-of-fractions rule, Part 37 does not apply, though other security requirements such as 10 CFR 20.1801-1802 for securing licensed material still do. Because inventories and thresholds can change, the determination should be documented and revisited whenever sources are added, replaced, or relocated.

Key Takeaways

Part 37 Subpart B is a personnel-security program. It vets the people who get unescorted access to Category 1 and 2 sources, complementing the physical-security barriers.
The reviewing official is the linchpin. They alone make T&R determinations, and they are themselves investigated, certified, and recertified every 10 years.
The background investigation has a defined scope. At least 7 years or since the eighteenth birthday, with fingerprinting and an FBI criminal history check.
Category thresholds decide applicability. Category 1 is 1,000× the D value and Category 2 is 10× the D value; Cs-137 and Co-60 devices are the usual medical triggers.
The sum-of-fractions rule aggregates sources. Individually modest sources can add up over the Category 2 line.
T&R is a documented judgment, not a checklist. And unescorted access can never precede that judgment.

Conclusion

Source security is often pictured as fences, cameras, and locks — but the most consequential decision a licensee makes may be who gets to walk past all of that unaccompanied. Part 37 Subpart B is the NRC's answer to the insider dimension of risk: a structured access authorization program that investigates people before they are trusted, concentrates the trust decision in an accountable reviewing official, and re-examines that official on a fixed cycle.

For a medical or research facility operating a Cesium-137 irradiator or a Cobalt-60 unit, a defensible Part 37 program is not optional and not something to reconstruct during an inspection. It is a standing workflow: a correct applicability determination, a certified reviewing official, a disciplined "escort until cleared" default, and protected records. Facilities that build that workflow deliberately protect their sources, their staff, and their license.

How DRPS Can Help

Diagnostic Radiation Physics Services helps licensees translate Part 37 into a working program. This can include the Category 1/2 applicability determination and sum-of-fractions analysis, access authorization and reviewing-official program design, background-investigation and information-protection procedures, and integration with the physical-security and license requirements — delivered through our radiation safety officer, radioactive material license support, and radiation safety training services.

DRPS supports facilities across our service locations, including Florida, Maryland, Virginia, Washington DC, California, Nevada, New York, Pennsylvania, New Jersey, and Delaware.

A strong security program makes the trustworthy path the routine path — for every person who holds a key.

Related Resources

References

U.S. Nuclear Regulatory Commission. 10 CFR Part 37: Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 37.23: Access authorization program requirements. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 37.25: Background investigations. ecfr.gov
U.S. Nuclear Regulatory Commission. Appendix A to Part 37 — Category 1 and Category 2 Radioactive Materials. nrc.gov
U.S. Nuclear Regulatory Commission. NUREG-2155, Rev. 1: Implementation Guidance for 10 CFR Part 37. nrc.gov
U.S. Nuclear Regulatory Commission. Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material (Part 37 overview). nrc.gov
International Atomic Energy Agency. Categorization of Radioactive Sources: IAEA Safety Standards Series No. RS-G-1.9. IAEA; 2005. iaea.org
International Atomic Energy Agency. Code of Conduct on the Safety and Security of Radioactive Sources. IAEA; 2004. iaea.org
U.S. Nuclear Regulatory Commission. 10 CFR Part 35: Medical Use of Byproduct Material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 20: Standards for Protection Against Radiation. ecfr.gov