Radioactive Source Security: 10 CFR Part 37

10 CFR Part 37 sets the U.S. security requirements for the most risk-significant radioactive materials — category 1 and category 2 quantities — with the objective of providing reasonable assurance against their theft or diversion. For a medical facility, the practical questions are whether your sources reach the thresholds (alone or aggregated), who may have unescorted access, how the material is monitored and protected, and how it is secured in transit.¹²³

A defensible Part 37 program starts with an honest aggregation of your inventory against the Appendix A thresholds, then builds trustworthiness-and-reliability determinations, security zones with immediate detection, local law-enforcement coordination, and transport controls on top of that.¹²⁴ This guide explains the structure and how it applies to medical sources.

Introduction

Part 37 exists because a handful of medical and industrial radioactive sources are concentrated enough to be a security concern, not just a radiation-safety concern. A cobalt-60 teletherapy head, a Gamma Knife, a high-dose-rate brachytherapy afterloader, and a self-shielded cesium-137 blood irradiator each concentrate enormous activity in a small, potentially portable package. The same properties that make them clinically useful make them material that must be protected against theft and diversion.¹³

The NRC published the Part 37 final rule on March 19, 2013, codifying security requirements that had previously been imposed through orders and increased-controls provisions after 2005. The rule implements the security framework of the International Atomic Energy Agency (IAEA) Code of Conduct on the Safety and Security of Radioactive Sources and its companion categorization, translating international thresholds into enforceable U.S. requirements.¹²⁸

For the radiation safety officer and the medical physicist, Part 37 is a program, not a single control: access authorization, security zones, monitoring and response, information protection, inventory and records, and transportation each carry specific requirements. This article walks through the thresholds, source aggregation with a worked example, the trustworthiness-and-reliability process, the physical-protection program, transport, and how the pieces fit together. DRPS supports facilities through its radioactive material license support and radiation safety officer services across Florida, Maryland, Virginia, Washington DC, California, Nevada, Pennsylvania, New York, New Jersey, and Delaware.

Topic Explanation

What Part 37 covers

Part 37 applies to any licensee that possesses an aggregated category 1 or category 2 quantity of radioactive material, sealed or unsealed. Its stated objective is to provide reasonable assurance of preventing theft or diversion of these quantities. The rule is organized into subparts covering background investigations and access authorization, the physical-protection program, and security during transportation.¹³

Key terms used throughout this guide:

Category 1 / Category 2 quantity — activity thresholds in Appendix A to Part 37, derived from the IAEA categorization; category 1 is the higher, more hazardous level and category 2 is one one-hundredth of it.²⁸
Aggregation — summing collocated activity of the same radionuclide to determine whether a threshold is met.¹
Reviewing official — the individual who makes trustworthiness-and-reliability determinations for unescorted access.¹
Unescorted access — access to category 1 or category 2 material without an approved escort, which requires a T&R determination.¹
Security zone — a temporary or permanent area where the material is used or stored under access control with monitoring and response.¹

The Appendix A thresholds

The thresholds are radionuclide-specific. The terabecquerel (TBq) values are the regulatory standard; the curie values are provided for convenience. The table below gives the thresholds for three radionuclides common in medical and industrial use.²

Radionuclide	Category 1 threshold	Category 2 threshold	Common medical/industrial form
Cobalt-60	30 TBq (810 Ci)	0.3 TBq (8.10 Ci)	Teletherapy, Gamma Knife, irradiators
Cesium-137	100 TBq (2,700 Ci)	1 TBq (27.0 Ci)	Self-shielded blood/research irradiators
Iridium-192	80 TBq (2,160 Ci)	0.8 TBq (21.6 Ci)	HDR brachytherapy, industrial radiography

A useful mental model: category 1 corresponds to sources that could cause permanent injury to a person handling them for minutes to hours, and category 2 to sources that could do so over hours. Category 2 is exactly one one-hundredth of category 1 for each radionuclide, reflecting the IAEA structure.²⁸

Key Technical Principles

Source aggregation

The threshold question is rarely about one source — it is about the collocated total. Part 37 requires aggregating the activity of the same radionuclide that is collocated, so a facility can fall under the rule even when no individual source reaches category 2. The standard way to evaluate a mixed inventory is the sum-of-ratios test against the relevant threshold.

For a single radionuclide with collocated sources of activity $A_{i}$ and category-2 threshold $T_{2}$ , the facility meets the category 2 quantity when:

i \sum \frac{A _{i}}{T _{2}} \geq 1

For example, consider a facility with three sealed cesium-137 sources of 12 TBq, 9 TBq, and 8 TBq collocated in one storage area. The category-2 threshold for Cs-137 is $T_{2} = 1$ TBq:

\frac{12}{1} + \frac{9}{1} + \frac{8}{1} = 29 \geq 1

The aggregate of 29 TBq is well above the 1 TBq category-2 threshold (and below the 100 TBq category-1 threshold), so the facility possesses a category 2 quantity and Part 37 applies — even though, in a different framing, an operator might have thought of the sources as "just three irradiator sources." When multiple radionuclides are present, each is evaluated against its own threshold; the rule's aggregation provisions and NUREG-2155 guidance describe how collocation is determined.¹⁴

Worked example: a mixed cobalt-60 inventory

Suppose a hospital has a Gamma Knife with a fresh cobalt-60 loading of approximately 250 TBq and, in a separate building, a self-shielded research irradiator with 4 TBq of cobalt-60. The category-1 threshold for Co-60 is 30 TBq and the category-2 threshold is 0.3 TBq.²

The Gamma Knife alone (250 TBq) exceeds the category-1 threshold (30 TBq) — it is a category 1 device.
The research irradiator alone (4 TBq) exceeds the category-2 threshold (0.3 TBq) — it is a category 2 device.

If the two are not collocated, each is evaluated where it sits, but the facility's overall Part 37 program must protect both at the appropriate category. Decay matters too: as a Gamma Knife or teletherapy source ages, its activity falls, and a source can drop below a threshold over time — which is why aggregation must be reassessed as inventory and source strength change.¹²

The hierarchy of requirements

Part 37's protections scale with category. Category 1 quantities carry the most stringent requirements — for example, additional monitoring and, for shipments, movement tracking and enhanced coordination — while category 2 quantities carry a robust but somewhat reduced set. The physical-protection objective is consistent across both: detect, assess, and respond to unauthorized access immediately enough to interrupt a theft or diversion attempt.¹³

Clinical Impact

For a clinical program, Part 37 reshapes who can be alone with a source and how the device room is controlled — operational realities, not just paperwork. A radiation oncology department running an HDR afterloader or a Gamma Knife, or a blood bank running a cesium-137 irradiator, has to translate the rule into daily practice:

Personnel. Only individuals with an approved trustworthiness-and-reliability determination may have unescorted access to the device and its storage. Everyone else must be escorted by an approved individual. This affects vendors, service engineers, housekeeping, and after-hours staff.¹
Physical space. The device room or storage becomes a security zone with access control and immediate detection. Door controls, monitoring, and an assessment-and-response plan have to be designed into the clinical workflow without impeding emergency access to the patient.¹
Coordination. The facility must have a documented relationship with local law enforcement so that a detected event triggers a timely armed response, and must protect security-sensitive information about the sources.¹

Done well, these controls are nearly invisible to clinical operations; done poorly, they create friction or — worse — gaps. The same risk-management discipline that underlies a strong ALARA program applies here: build the secure process into the routine so the safe and compliant path is also the easy one.

Practical Optimization Tips

A practical Part 37 program follows a consistent sequence.

1. Inventory and aggregate first

List every sealed and unsealed source by radionuclide and current activity, identify what is collocated, and run the sum-of-ratios test against the Appendix A thresholds. This determines whether — and at what category — Part 37 applies. Reassess whenever sources are added, removed, exchanged, or decay across a threshold.¹²⁴

2. Establish the reviewing official and T&R process

Designate the reviewing official and implement the background-investigation process for unescorted access, including fingerprinting and the FBI criminal-history records check. Maintain the access-authorization list and the documentation supporting each determination.¹

3. Build the security zones

Define the temporary and permanent security zones, implement access controls, and ensure the monitoring, detection, assessment, and response capability meets the immediate-detection objective. Document the local law-enforcement coordination.¹

4. Protect information and maintain records

Control security-sensitive information about source location, quantities, and protective measures. Keep the records the rule requires — access lists, T&R determinations, program reviews, and reviews of the response arrangements.¹

5. Plan for transport before you ship

Coordinate shipments in advance, arrange redundant communications, and for category 1 shipments implement the additional measures such as movement tracking. Integrate Part 37 transport requirements with DOT hazardous-materials rules.¹⁵

Common Part 37 pitfalls to avoid

Forgetting aggregation. Multiple sub-threshold sources can collectively trigger the rule.¹
Granting unescorted access without a completed T&R. Vendors and service staff are a frequent gap.¹
Treating the security zone as static. Temporary use locations and storage during service also need controls.¹
Neglecting decay reassessment. A source can move between categories — usually downward — as it decays.²
Weak law-enforcement coordination. A detection capability without a response arrangement does not meet the objective.¹
Mixing up safety and security records. Part 37 documentation is distinct from Part 20 dose records and must be maintained and protected on its own terms.¹⁶

Regulatory Considerations

Part 37 sits within the broader NRC and Agreement State framework for byproduct material and works alongside, not instead of, the radiation-safety and transport rules. The complete compliance picture for a facility with category 1 or 2 material spans several regulations:

10 CFR Part 37 — Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material. The security program itself: access authorization, physical protection, and transportation security.¹
Appendix A to Part 37. The category 1 and category 2 threshold table that drives applicability and aggregation.²
NRC NUREG-2155, Revision 2. The current implementation guidance for Part 37, providing the NRC staff's recommended methods for meeting each requirement.⁴
10 CFR Part 20 and 10 CFR Part 35. The radiation-protection and medical-use rules that govern the same sources for safety, dose limits, and authorized use.⁶⁷
IAEA Code of Conduct and categorization. The international basis for the category thresholds Part 37 implements.⁸

Agreement States administer their own compatible programs. Of the states DRPS serves, Florida, Maryland, Virginia, California, Nevada, Pennsylvania, New York, and New Jersey are NRC Agreement States that implement compatible security requirements under their own rules, while Washington, DC and Delaware are regulated directly by the NRC. A facility must verify which authority issues its license and confirm the exact security requirements that apply. For related compliance topics, see our guides to preparing for an NRC inspection and radioactive material transport under DOT rules.

Frequently Asked Questions (FAQs)

What is 10 CFR Part 37?

10 CFR Part 37 is the U.S. Nuclear Regulatory Commission regulation establishing security requirements for category 1 and category 2 quantities of radioactive material — the most risk-significant quantities. Its objective is to provide reasonable assurance against the theft or diversion of these materials, and it applies to both sealed and unsealed material at or above the category 2 threshold.

What are category 1 and category 2 quantities?

Category 1 and category 2 are activity thresholds defined in Appendix A to Part 37, derived from the IAEA Code of Conduct. Category 1 is the higher, more hazardous threshold and category 2 is one one-hundredth of it. For example, the category 1 and category 2 thresholds for cesium-137 are 100 TBq and 1 TBq, and for cobalt-60 are 30 TBq and 0.3 TBq.

How does source aggregation work under Part 37?

A facility must aggregate the activity of radioactive material of the same radionuclide that is collocated. If the sum reaches or exceeds the category 2 threshold, Part 37 applies even if no single source does. Aggregation is evaluated by summing the ratios of each source's activity to the relevant threshold, and a combined ratio of one or more meets the category.

What is trustworthiness and reliability under Part 37?

Trustworthiness and reliability (T&R) is the determination that an individual may be granted unescorted access to category 1 or category 2 material. For unescorted access, the rule requires a background investigation including fingerprinting and an FBI criminal history records check, with the reviewing official making the access determination.

Does Part 37 apply to medical facilities?

Yes. Many medical devices contain category 1 or category 2 quantities, including cobalt-60 teletherapy and Gamma Knife units, high-dose-rate brachytherapy afterloaders, and self-shielded cesium-137 or cobalt-60 irradiators. Facilities possessing these at or above the category 2 threshold must implement a Part 37 security program.

What is a security zone?

A security zone is any temporary or permanent area where category 1 or category 2 material is used or stored, with controls that allow access only to approved individuals. The rule requires monitoring, detection, assessment, and response capabilities so that any unauthorized access attempt is detected immediately and a response can be initiated.

How does Part 37 address transportation?

Part 37 includes physical-protection requirements during shipment of category 1 and category 2 quantities, including advance coordination, redundant communication, and for category 1 shipments, additional measures such as movement tracking. These requirements work alongside U.S. Department of Transportation hazardous-materials rules for radioactive material.

Key Takeaways

Part 37 protects the most risk-significant materials — category 1 and category 2 quantities — against theft and diversion, and applies to sealed and unsealed material at or above the category 2 threshold.¹
The Appendix A thresholds are radionuclide-specific: for example, Cs-137 category 1/2 are 100/1 TBq and Co-60 are 30/0.3 TBq, with category 2 always one one-hundredth of category 1.²
Aggregation can trigger the rule: collocated sub-threshold sources are summed against the threshold via the sum-of-ratios test.¹
Unescorted access requires trustworthiness and reliability, including fingerprinting and an FBI criminal-history check approved by the reviewing official.¹
Security zones must detect, assess, and respond immediately, backed by documented local law-enforcement coordination.¹
Transport and decay both matter: shipments carry their own Part 37 requirements, and aggregation must be reassessed as sources decay across thresholds.¹²

Conclusion

10 CFR Part 37 turns a small set of high-activity medical and industrial sources into a managed security program. The logic is sequential: aggregate the inventory against the Appendix A thresholds to determine applicability and category; grant unescorted access only to individuals who have passed a trustworthiness-and-reliability determination; build security zones that detect, assess, and respond to unauthorized access immediately; coordinate with local law enforcement; protect sensitive information; and secure the material in transit.¹²⁴

For the RSO and medical physicist, the goal is a program that satisfies the rule without impeding clinical care — one where the secure path is the routine path. Facilities that map their sources honestly, keep aggregation current as inventory and decay change, and document each element will be well positioned to protect their material and defend the program at inspection.

How DRPS Can Help

Diagnostic Radiation Physics Services helps facilities translate Part 37 into a practical, documented security program. This may include source inventory and aggregation analysis against the Appendix A thresholds, security-program and security-zone design support, trustworthiness-and-reliability process guidance, radioactive material license support, radiation safety officer consulting, and radiation safety training aligned with NRC and Agreement State requirements.

DRPS supports facilities across our service locations, including Florida, Maryland, Virginia, Washington DC, California, Nevada, New York, Pennsylvania, New Jersey, and Delaware. A strong source-security program is not just about passing an inspection — it is about making sure risk-significant material stays accounted for, protected, and under control.

Related Resources

References

U.S. Nuclear Regulatory Commission. 10 CFR Part 37: Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material. ecfr.gov
U.S. Nuclear Regulatory Commission. Appendix A to Part 37 — Category 1 and Category 2 Radioactive Materials. nrc.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 37 — Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material (program overview). nrc.gov
U.S. Nuclear Regulatory Commission. Implementation Guidance for 10 CFR Part 37, NUREG-2155, Revision 2. nrc.gov
U.S. Nuclear Regulatory Commission. § 37.79 Requirements for physical protection of category 1 and category 2 quantities of radioactive material during shipment. nrc.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 20: Standards for Protection Against Radiation. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 35: Medical Use of Byproduct Material. ecfr.gov
International Atomic Energy Agency. Code of Conduct on the Safety and Security of Radioactive Sources and RS-G-1.9, Categorization of Radioactive Sources. iaea.org