Securing Licensed Material: 10 CFR 20.1801/20.1802

Every quantity of licensed radioactive material a facility holds must, at all times, be either secured against unauthorized removal or under the constant surveillance of someone who can control access. That single principle is the whole of 10 CFR 20.1801 and 20.1802, and failing it is one of the most frequently cited findings in NRC and Agreement State materials inspections. ¹²⁸

These two short regulations are deceptively simple, but they apply to every source in the building—not just the large ones covered by the physical-protection rules of Part 37. This guide explains what the rules require, how they differ from Part 37, how they connect to public dose limits, and how to build a control-and-security program that holds up under inspection.

Introduction

10 CFR Part 20, Subpart I—"Storage and Control of Licensed Material"—contains two sections that together define the baseline security expectation for all NRC and Agreement State licensees. ³

§20.1801, Security of stored material: the licensee shall secure from unauthorized removal or access licensed materials that are stored in controlled or unrestricted areas. ¹
§20.1802, Control of material not in storage: the licensee shall control and maintain constant surveillance of licensed material that is in a controlled or unrestricted area and that is not in storage. ²

Read together, they establish a binary that never has a gap: at any instant, a given quantity of licensed material is either in storage and secured (20.1801) or not in storage and under constant surveillance (20.1802). There is no third, permissible state in which material is both unsecured and unwatched. ¹²

For medical, research, and industrial licensees, meeting this standard is a daily operational discipline as much as a written procedure. DRPS supports facilities in building that discipline through radiation safety officer and radioactive material license support services.

Topic Explanation

The two states: stored versus in use

The regulations turn on whether material is "in storage." Material in storage—a source in a locked safe, a decaying vial in a locked hot lab, sealed sources in a secured cabinet—must be secured from unauthorized removal or access. Material not in storage—a dose drawn up and staged for administration, a sealed source in use for a calibration, a waste container being filled—must be under constant surveillance and control. ¹²

The definitions that anchor these terms come from 10 CFR 20.1003: a controlled area is an area outside a restricted area but inside the site boundary, access to which the licensee limits for any reason; an unrestricted area is an area to which access is neither limited nor controlled by the licensee. ⁴ Both sections explicitly reach material in controlled and unrestricted areas, which is why a source in a nominally staff-only corridor still requires either securing or surveillance.

What "secured" and "constant surveillance" mean in practice

Secured generally means physically preventing unauthorized removal or access—locks, locked rooms, secured containers, and access controls that a passerby cannot defeat. Constant surveillance means an individual is continuously watching the material and is positioned and able to control access and respond to any unauthorized attempt to remove or approach it. ²

The common failure is treating a room's ordinary staffing as surveillance when it is not. A dose left on a counter while the technologist steps away, in a room that a patient, visitor, or housekeeper could enter, is neither secured nor under constant surveillance—even if the room is "usually" occupied. ⁸

Scope: all licensed material, not just big sources

A critical and frequently misunderstood point: 20.1801 and 20.1802 apply to all licensed material. They are not limited to sources above any activity threshold. A single Tc-99m unit dose, a small sealed check source, a Cs-137 dose-calibrator source, and a waste container of decaying vials are all subject to the secure-or-surveil requirement. ¹² This is different from 10 CFR Part 37, which imposes a much more stringent physical-protection program but only for Category 1 and Category 2 (risk-significant) quantities. See our companion post on radioactive source security under Part 37. ⁸

Key Technical Principles

Comparing the control-and-security frameworks

Feature	10 CFR 20.1801	10 CFR 20.1802	10 CFR Part 37
Title	Security of stored material	Control of material not in storage	Physical Protection of Category 1 and 2 Quantities
Applies to	All licensed material in storage	All licensed material not in storage	Only Category 1 and 2 (risk-significant) quantities
Core requirement	Secure from unauthorized removal or access	Control and maintain constant surveillance	Access controls, monitoring, background checks, coordinated response
Typical implementation	Locks, locked rooms, secured containers	Continuous attendance by a responsible individual	Documented security plan, trustworthiness and reliability program
Where it lives	Part 20, Subpart I	Part 20, Subpart I	Standalone Part 37
Most common failure mode	Unlocked storage during breaks or after hours	Unattended material in accessible areas	Incomplete or unimplemented security plan

The three frameworks stack: every licensee meets 20.1801 and 20.1802 for all material, and those that also possess Category 1 or 2 quantities layer Part 37 on top. Mapping which materials fall where is a foundational radiation-safety task. ¹²⁸

Worked example: why control protects public dose limits

Securing material is not an abstract security rule; it directly protects the public dose limits in 10 CFR 20.1301—1 mSv (100 mrem) in a year and 0.02 mSv (2 mrem) in any one hour in an unrestricted area. ⁵ Consider an unsecured source producing a measured dose rate of $\dot{D}_{0} = 0.5$ mSv/h at $d_{0} = 0.3$ m. Dose rate falls with the inverse square of distance:

\dot{D} (d) = \dot{D}_{0} (\frac{d _{0}}{d})^{2}

At $d = 1$ m from the unsecured source:

\dot{D} (1 m) = 0.5 \frac{mSv}{h} \times (\frac{0.3}{1.0})^{2} = 0.5 \times 0.09 = 0.045 \frac{mSv}{h}

A member of the public standing 1 m away for one hour would receive about 0.045 mSv—already more than double the 0.02 mSv "any one hour" unrestricted-area limit. ⁵ The time to reach the 1 mSv annual public limit at that dose rate is:

t = \frac{1 mSv}{0.045 mSv/h} \approx 22 h

An unattended source in an accessible waiting area could plausibly accumulate that exposure to a member of the public over days. Securing or maintaining surveillance of the source is what prevents it. This is why 20.1801/20.1802 compliance is simultaneously a security requirement and a dose-limit safeguard. (The numbers here are illustrative; actual dose rates depend on the radionuclide, activity, and shielding.)

The inspection lens

Inspectors evaluate control and security by direct observation and by testing the licensee's procedures against practice. They look for material that is neither locked nor watched, access-control arrangements that can be casually defeated, storage that is unlocked during breaks or after hours, and waste or decay areas accessible to non-radiation staff such as housekeeping. Consistency between the written program and observed behavior is the crux. ⁸

Clinical Impact

In a working medical or research department, the risk is not usually theft of a large source; it is the routine lapse that leaves a small quantity briefly unsecured and unwatched. ¹²⁸

Nuclear medicine and PET workflows create many transient states in which material is "not in storage": a dose staged before administration, a syringe carried between the hot lab and the imaging suite, a waste bin filling in a procedure room, a decaying source set aside for storage. Each of these is a 20.1802 moment that demands either continuous attendance or a return to secured storage. The busier the department, the more of these moments occur, and the easier it is for one to slip—an interruption, a shift change, a phone call that pulls the responsible individual out of the room. ⁸

The consequences of a lapse extend beyond a citation. Unsecured material can expose members of the public above the 20.1301 limits, can be removed without authorization, and undermines the licensee's demonstrated control of its program—an issue that colors an inspector's view of the entire radiation-safety operation. Conversely, a department with visibly disciplined securing and surveillance signals a well-run program. For the broader picture of avoidable citations, see common radiation safety violations and preparing for an NRC inspection.

Practical Optimization Tips

A defensible control-and-security program turns the secure-or-surveil principle into habits that survive a busy day.

1. Map every material state

List where licensed material exists in each state—stored versus in use—across receipt, preparation, administration, calibration, decay-in-storage, and waste. Each state needs a defined securing or surveillance arrangement. ¹²

2. Make secured storage the default

When material is not actively in use and watched, it should be in locked storage. Locks on the hot lab, secured source cabinets, and access-controlled decay and waste areas make "secured" the resting state so that lapses require an active mistake, not merely inattention. ¹

3. Define surveillance responsibility explicitly

For material in use, name who is responsible for constant surveillance and what "handing off" looks like. Surveillance must not evaporate during breaks, interruptions, or shift changes. ²

4. Control access, don't just post it

A sign is not a control. Locks, badge access, and physical barriers keep material secured from unauthorized removal or access; ordinary staffing does not substitute for either securing or surveillance in accessible areas. ¹²

5. Separate the Part 37 population

Identify which sources are Category 1 or 2 quantities that trigger Part 37, and build the more stringent physical-protection program for those on top of the Part 20 baseline. ⁸

6. Document and train

Written security and control procedures, source inventories and use logs, and staff training convert intent into evidence. During an inspection, documented procedures matched by observed practice is the standard of proof. ⁶

Common pitfalls to avoid

Assuming small doses are exempt. 20.1801/20.1802 apply to all licensed material, regardless of activity.
Treating occupancy as surveillance. A "usually staffed" room is not constant surveillance if material can be accessed while unattended.
Unlocked storage during downtime. Breaks, lunches, and after-hours are prime lapse windows.
Neglecting waste and decay areas. Decaying material is still licensed material and must be secured or watched.
Relying on signage. Postings inform; they do not secure or control.
No hand-off protocol. Surveillance responsibility must transfer deliberately, never lapse silently.

Regulatory Considerations

10 CFR 20.1801 and 20.1802 are baseline requirements that every NRC and Agreement State materials licensee must meet, reinforced by licensing guidance and layered with additional rules for larger sources. ¹²⁶

10 CFR Part 20, Subpart I houses both sections and frames them within the standards for protection against radiation, including the public dose limits of §20.1301 that control and security protect. ³⁵
NUREG-1556, Volume 9, Revision 3 (2019) provides program-specific guidance for medical-use licensees, including the security, control, and inventory expectations that support a compliant application and program. ⁶
10 CFR Part 35 governs the medical use of byproduct material and the RSO's responsibilities, within which control and security are implemented. ⁷
10 CFR Part 37 adds a stringent physical-protection program for Category 1 and 2 quantities—an overlay, not a replacement, for the Part 20 baseline. ⁸
10 CFR 30.34 binds licensees to the terms and conditions of their license, including committed security procedures. ⁹
International guidance—IAEA GSR Part 3 and the IAEA Code of Conduct on the Safety and Security of Radioactive Sources—frames the same secure-and-control principle within the international safety and security standards. ¹⁰¹¹

Jurisdiction depends on the material and the state. Radioactive material is regulated by the NRC or an Agreement State; among the states DRPS serves, Florida, Maryland, Virginia, California, Nevada, Pennsylvania, New York, and New Jersey are NRC Agreement States that administer their own equivalent rules, while Washington DC and Delaware are regulated directly by the NRC. A facility must confirm which authority issues its license and align its control-and-security program—and its documentation—with that authority's requirements. Our radioactive material license support and radiation safety training services help facilities build and verify that alignment.

Frequently Asked Questions (FAQs)

What do 10 CFR 20.1801 and 20.1802 require?

Section 20.1801, Security of stored material, requires the licensee to secure from unauthorized removal or access licensed materials stored in controlled or unrestricted areas. Section 20.1802, Control of material not in storage, requires the licensee to control and maintain constant surveillance of licensed material that is in a controlled or unrestricted area and is not in storage. In short: material is either secured or under constant surveillance at all times.

Do these rules apply to small sources and to nuclear medicine doses?

Yes. Unlike 10 CFR Part 37, which applies only to Category 1 and 2 (risk-significant) quantities, 10 CFR 20.1801 and 20.1802 apply to all licensed material a licensee possesses. A single unit dose, a sealed calibration source, a decaying vial in a hot lab, and a waste container are all covered.

What does 'constant surveillance' mean under 20.1802?

Constant surveillance means the material not in storage is continuously watched by an individual who can control access and respond to unauthorized attempts to remove or access it. A dose sitting on an unattended counter in an area accessible to the public is neither secured nor under constant surveillance and does not meet 20.1802.

Why is this one of the most common inspection findings?

Because it is easy to lapse in daily practice: an unlocked hot lab during a break, a source left in an unattended room, a waste area accessible to housekeeping, or a syringe staged in a hallway. Inspectors routinely observe these lapses, and failure to secure or control licensed material is among the most frequently cited materials violations.

Does securing material replace a written security program?

No. 20.1801 and 20.1802 are the baseline control-and-security requirements. Facilities with Category 1 or 2 quantities must additionally meet the more stringent physical-protection requirements of 10 CFR Part 37. A facility should map which materials fall under only Part 20 and which also trigger Part 37.

How does securing material relate to public dose limits?

Control and security directly protect the public dose limits in 10 CFR 20.1301: 1 mSv (100 mrem) total effective dose equivalent in a year and 0.02 mSv (2 mrem) in any one hour in an unrestricted area. An unsecured source in an accessible area can expose a member of the public above these limits, so control is both a security and a dose-limit requirement.

What documentation supports compliance?

Facilities should document their security and control procedures, lock and access-control arrangements, surveillance practices, source inventories and use logs, and staff training. During an inspection, this documentation plus consistent practice demonstrates that material is reliably secured or under constant surveillance.

Key Takeaways

Secure or surveil, always. At every instant, licensed material must be either secured in storage (20.1801) or under constant surveillance in use (20.1802).
All material, no threshold. These sections apply to every quantity of licensed material, unlike Part 37's risk-significant scope.
Occupancy is not surveillance. A usually-staffed room does not satisfy 20.1802 if material can be accessed unattended.
It protects public dose limits. Control and security safeguard the 20.1301 limits of 1 mSv/year and 0.02 mSv in any one hour in unrestricted areas.
It's a top inspection finding. Lapses—unlocked storage, unattended doses, accessible waste—are among the most frequently cited materials violations.
Stack the frameworks. Meet 20.1801/20.1802 for all material and layer Part 37 on Category 1 and 2 quantities.

Conclusion

The most-cited security requirements in materials licensing are also the simplest to state: secure it, or watch it. What makes 10 CFR 20.1801 and 20.1802 hard is not their complexity but their relentlessness—they apply to every source, in every state, at every moment of a busy clinical day. The lapses that draw citations are almost never deliberate; they are the unlocked lab over lunch, the dose left while answering a page, the waste area a housekeeper can enter.

A strong program makes secured storage the default, names who holds surveillance and how it hands off, controls access with locks rather than signs, and documents all of it. That discipline protects members of the public, prevents unauthorized removal, and demonstrates to an inspector that the licensee genuinely controls its material. It is the foundation on which the rest of the radiation-safety program stands.

How DRPS Can Help

Diagnostic Radiation Physics Services helps licensees translate the secure-or-surveil principle into practical, documented programs. This includes radiation safety officer support, control-and-security procedure development, source inventory and use-log systems, Part 20 versus Part 37 scoping, inspection readiness reviews, radioactive material license support, and radiation safety training for staff who handle licensed material.

DRPS supports facilities across our service locations, including Florida, Maryland, Virginia, Washington DC, California, Nevada, New York, Pennsylvania, New Jersey, and Delaware.

The safe practice is the one that is also the easy default—material that is always either locked or watched.

Related Resources

References

U.S. Nuclear Regulatory Commission. 10 CFR 20.1801: Security of stored material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 20.1802: Control of material not in storage. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 20, Subpart I: Storage and Control of Licensed Material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 20.1003: Definitions (controlled area, restricted area, unrestricted area). ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 20.1301: Dose limits for individual members of the public. ecfr.gov
U.S. Nuclear Regulatory Commission. NUREG-1556, Volume 9, Revision 3: Consolidated Guidance About Materials Licenses — Program-Specific Guidance About Medical Use Licenses. 2019. nrc.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 35: Medical Use of Byproduct Material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 37: Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 30.34: Terms and conditions of licenses. ecfr.gov
International Atomic Energy Agency. Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards (IAEA Safety Standards Series No. GSR Part 3). 2014. iaea.org
International Atomic Energy Agency. Code of Conduct on the Safety and Security of Radioactive Sources. 2004. iaea.org