Prioritize personnel-related security measures

Countries and areas with weapons-usable nuclear materials or nuclear facilities should close the gaps in human-focused security requirements with the following actions:

• Mandate annual self-assessments of security culture at nuclear facilities and create positions solely responsible for managing security culture, in accordance with International Atomic Energy Agency security guidance
• Establish comprehensive personnel vetting programs that require background checks, psychological screening, and drug testing of personnel on a regular, defined basis
• Design employee assistance programs that help personnel facing personal or mental health challenges and enable early identification of concerning behaviors
• Require incident reporting at the personnel and institutional level, with facility operators reporting incidents to the appropriate regulatory authority and individuals reporting any suspicious behavior to a security authority within the facility
• Create formal, anonymous mechanisms for personnel to report security concerns, near-misses, and suspicious behavior and establish legal protections against retaliation
• Connect security responsibilities to the broader mission of the organization, empowering employees to take ownership of security outcomes, encouraging feedback and participation in improvement efforts, and fostering ongoing dialogue on security performance and emerging challenges
• Institute requirements for all personnel to participate in awareness programs on cybersecurity and insider threat prevention to raise awareness and promote a security culture.

What the Data Show

Personnel-related nuclear security measures—including insider threat prevention, security culture, and comprehensive vetting programs—are weak or absent in most countries and areas with weapons-usable nuclear materials or nuclear facilities.

Data Details

In nearly every documented case of nuclear theft or sabotage, insiders who have authorized access to and deep knowledge of a given nuclear facility have played a role in facilitating the crime. Insiders’ access and trust make them the most credible and dangerous threat vector. Regardless of its design or technical sophistication, a security system is only as reliable as the
people who work within it.

Three fundamental personnel-related security measures for preventing theft and sabotage are:

• Regular, comprehensive personnel vetting
• Security culture assessments, which measure gaps
  in performance, attitude, and behavior that could
  jeopardize security and inform improvements to
  personnel vetting and awareness programs
• Incident and suspicious activity reporting protocols.

These measures are mutually reinforcing, as employees are more likely to effectively implement their nuclear security responsibilities when a healthy security culture exists. Unfortunately, the 2026 NTI Index finds that countries and areas with weapons-usable nuclear materials or nuclear facilities have a median score of only 50 out of 100 on both Security Culture and Insider Threat Prevention. These scores consistently lag scores for other core elements of security. For example, the same group of countries and areas has a median score of 71 out of 100 on On-Site Physical Protection Measures.

Those low scores reveal an alarming reality. For example, Algeria, Bangladesh, Egypt, Kazakhstan, Mexico, Morocco, and South Africa have no regulatory requirements to screen personnel before hiring them, a first-line defense against insider threats. The countries that do require personnel vetting have uneven protocols: Only 20 countries have comprehensive programs that include background checks, drug tests, and psychological or mental fitness evaluations, and 21 countries have no specified regular intervals for personnel vetting. Since the 2023 NTI Index, Canada, Indonesia, the United Arab Emirates, and Uzbekistan are the only countries that have made any improvements to their personnel vetting requirements.

Every day that governments delay implementation of these human-focused security requirements, they are leaving known, addressable vulnerabilities exposed to highly credible threats. Despite the established record of serious and consequential insider threats, government efforts to implement essential human factor security requirements still lag international best practice.