Reaching the Tipping Point?

Annual Report 2018

THE WORLD INSTITUTE FOR NUCLEAR SECURITYPromoting nuclear security best practices and security leadership around the world

2

Throughout history, there have been “tipping points” that have rapidly affected society and business, including new ideas, new discoveries, and new technology. Some of these have been immensely beneficial to the development of society; other tipping points have led to war and conflict, disease and strife.

Tipping points have also occurred in the civil nuclear sector. A small number of safety incidents have significantly impacted on public and political support for nuclear energy and led to widespread changes and improvements in nuclear safety management. Nuclear safety is now nearly every nuclear organisation’s “Number 1 priority.”

But what about nuclear security?

In the absence of any major nuclear security event, we have clearly seen incremental improvements and enhancements to security, with some examples of excellent performance. But much remains to be done to bring security governance, programmes and competence to a level that is on a par with safety.

What will it take to create a positive tipping point (short of a major security event) in which the examples of the few motivate the majority of nuclear-related organisations worldwide to take action to implement performance-based security management systems, develop integrated approaches to risk management, and establish a unified culture of safety and security?

What will it take for regulators and operators to realise that they already have all the tools necessary to establish resilient security systems?

The answer is that it only requires senior management to focus on the issue and integrate security into their mainstream business and risk management processes. It requires that they engage with employees, eradicate unnecessary secrecy, and diversify the thinking and composition of those that provide a security service. That’s all.

Short of such action, there remains the possibility that a negative tipping point (i.e. security incident) will make the changes inevitable, disruptive and very expensive.

The tipping point is that magic moment when an idea, trend, or social behaviour crosses a threshold, tips, and spreads like wildfire. Malcolm Gladwell, Author of The Tipping Point

“

3

Chairman’s Letter 4

The WINS Board 5

The Executive Director’s Report 6

WINS Summary of Achievements in 2017 8

WINS Suite of Services

Sharing Operational Experience 10

Knowledge Centre 14

Training and Certification 18

Evaluation 20

Support Processes 21

Website and Communication 22

Financial Performance 24

The WINS Team 26

2018 Targets 28

Funding Organisations 30

Table of Contents

4

The WINS team has much to be proud of in its 2017 efforts to improve nuclear security. More than 80 percent of members and participants continue to report that the security practices identified and promoted by WINS tangibly affect their operations.

The WINS academy is well-launched, with a complete set of courses and a growing cohort of graduates, and is now backed by 14 leading nuclear nations through the International Atomic Energy Agency’s Information Circular 901. We are approaching, but have not yet reached, the point where a strong and integrated nuclear security culture for organizations responsible for fissile material is an internationally implemented norm.

As we anticipate its tenth anniversary, WINS will encourage the nuclear industry to re-engage on these issues after the Nuclear Industry Summits. WINS will also launch efforts to improve gender equality and diversity in the field, which cannot afford—morally or practically—to discourage or discriminate against talented people. All this is in pursuit of sustainable frameworks demanding demonstrable competence in the field of nuclear security. WINS itself embodies this commitment through ISO certification, strict financial controls, and independent auditing.

The WINS board is evolving. We thank departing member Dr. Joan Woodard for her wise counsel, and are in the midst of announcing new members of an expanded board for 2018. The board seeks to represent the personal, organizational, and national diversity of those responsible for nuclear security.

Most of all, WINS is committed to continuous improvement, of itself and the important endeavors it serves.

William H. Tobey, WINS Chairman

Chairman’s Letter

5

Dr. John BarrettPresident and CEO of the Canadian

Nuclear Association (CNA)

Duncan HawthorneChief Executive Officer, Horizon Nuclear Power

F O R F U L L B I O G R A P H I E S

O F T H E W I N S B O A R D

M E M B E R S , V I S I T

W W W . W I N S . O R G

Dr. Paul HardingAdvisor to CEO URENCO Ltd in

the field of small and medium sized reactors (SMR) development

The WINS Board

6

The Executive Director’s Report

This is the ninth annual report from WINS, and we are now looking forward to marking the tenth anniversary of our initial launch to coincide with the IAEA’s General Conference in September.

2017 was another extremely busy year for us. WINS organised over 20 events around the world, and our membership increased to over 4,000. By the end of the year, the number of participants in the WINS Academy exceeded 1,000. Furthermore, almost 300 had passed their examinations and joined the WINS Alumni.

In 2018, one of our major priorities will again be to encourage as many participants as possible to complete their examinations. This goal will be greatly facilitated by our newly designed website, integrated management system, and improved data analytics.

We have noticed a significant change in attitude across the nuclear security community in the last year, as more and more organisations and professionals realise that the old divisions between safety and security, and between physical protection and cyber security, are no longer appropriate. We are also seeing a shift in the attitude of regulators away from prescriptive regulation towards outcome-focused regulation, where operators are expected to be the controlling mind and to demonstrate how they achieve high-performing, resilient security programmes. This change in attitude is essential as the threats to nuclear and radioactive materials continue to evolve rapidly, and the dual-use nature of advanced technologies

presents both concerns and opportunities.

It is the responsibility of executive managers and their boards of directors to proactively lead these changes. Although there are pockets of excellence, we believe more needs to be done to improve governance and oversight arrangements for nuclear security.

Dr. Roger Howsley, WINS Executive Director

7

In 2018, we will continue to encourage senior management to engage more effectively in this area. To support this objective, we will provide operators and regulators with more tools and techniques, including methodologies for peer review.

Have we actually reached a tipping point in which nuclear security is considered to be an integral part of an organisation’s overall risk management framework driven by performance and competent professionals? In some countries, yes. In many other countries, there is still considerable work to do to address inertia and achieve the levels of resilience that society justifiably expects.

I would like to express my appreciation to the governments, foundations, corporate organisations and individuals who support WINS and our mission. I would also like to thank the WINS team and Board of Directors for their dedication and commitment. In particular, I would like to thank our Members and WINS Alumni for the contributions and sustainable progress they are making in this essential area of human endeavour.

8

WINS Summary of Achievements in 2017

P Our membership grew to over 4,000 participants from over 120 countries.

P We conducted 20 workshops, roundtables, and other events in ten countries (Austria, Canada, Japan, Mexico, South Africa, UAE, UK, Nigeria, Jordan and USA).

P Our WINS Academy grew to over 1,000 participants from 82 countries. 288 participants have become Certified Nuclear Security Professionals (CNSPs) as of 31 December 2017.

P In December 2017, we achieved ISO29990:2010 recertification for learning services and passed the surveillance audit for ISO9001:2015.

P We published an ISO29990 Certification Handbook to assist Nuclear Security Support Centres.

P We worked with the Mexican National Nuclear Research Institute on the development of their regional training centre.

Our members come from

different countries120 288

Certified Nuclear Security Professionals (CNSPs) as of the end of 2017

9

P In cooperation with WANO, we developed a methodology for Peer Review that can assess the effectiveness of corporate oversight arrangements for security.

P We published two new International Best Practice Guides on Countering Homegrown Violent Extremism and Insider Threats, and Peer Review Guidelines to Assess the Security of Radioactive Sources Used in Medical Applications.

P We launched the Comparative Review of nuclear and aviation security management, regulation and international oversight.

P We fully redesigned our website and database management system. In a survey taken after the new site was launched, 98% of respondents said they preferred the new design over the previous one.

1,000+participants of our

WINS Academy

10

WINS hosts a variety of workshops, training courses, roundtables and webinars annually in locations around the world. All of these events use innovative, hands-on methods–from brief presentations by subject matter experts to small group exercises and interactive polls–that actively engage participants in their own learning. Such approaches not only increase participants’ knowledge and skills, but they also provide the opportunity for participants to network with each other while sharing best practices and lessons learned.

Participants regularly indicate that they find the workshops both interesting and useful. For example, in Post Workshop Surveys of five events that took place from January to June 2017, 99% of participants said that the workshop they had attended was excellent or very good, and 97% said they would recommend a WINS event to others.

2017 Event Statistics In 2017, WINS conducted 20 workshops, roundtables, and other events in 10 countries (Austria, Canada, Japan, Mexico, South Africa, UAE, UK, Nigeria, Jordan and USA). Since 2008, more than 3,300 people from 23 countries have participated in at least one WINS workshop.

Workshop quotes:

“ It was a very informative two and a half days for me, and I particularly enjoyed listening to the speakers on the threats and the different perspectives on how countries are responding to these.

– EDF Energy Generation, UK (Workshop on Homegrown Violent Extremism)

“ We both feel that this workshop was well planned, organized and addressed critical matters related to Strengthening Safety and Security.

– US medical practitioner, (Workshop on Radioactive Source Security Culture)

Sharing Operational Experience

20+

3,300+

Workshops, roundtables and other events in 2017

Workshop attendees since 2008

WINS SUITE OF SERVICES

11

Dec 09 Dec 11 Dec 13 Dec 15 Dec 17

4,313

3,850

3,500

3,150

2,800

2,450

2,100

1,750

1,400

1,050

700

350

0

3,300+ 23 97%Number of

participants in WINS workshops to date

Number of countries in which we have held

events

Of attendees in 2017 would recommend a

WINS event to others

members as of December 2017

WINS Membership

4,313

12

Annual Survey Results

Sharing Operational ExperienceWINS SUITE OF SERVICES

QUESTION Percentage Agree 2017

� I benefit from WINS Membership. 94.4%

� WINS is a valuable forum. 98.9%

� The WINS guides are effective for self-assessment. 96.7%

� The WINS guides cover relevant topics. 97.9%

� Have you attended a WINS workshop? 40.5%

� WINS workshops are innovative. 95.5%

� Attending a WINS workshop was time well spent. 93.4%

� I have modified approaches to security because of WINS. 82.4%

13

“ Excellent forums for sharing best practice and information. I hope to continue being a part of these workshops in the future.”

– WINS Workshop Participant

“ Every workshop is very informative and provides opportunities to see how others view the problem and solutions.”

– WINS Workshop Participant

� The WINS website is useful. 97.1%

� I am enrolled in/have completed the WINS Academy Certification Programme for Nuclear Security Management.

36.3 % of members who completed the survey are enrolled in the WINS Academy.

� My competence in nuclear security has improved because of the WINS Academy courses.

92% of enrolled participants who completed the survey indicated that their competence in nuclear security has improved because of WINS Academy courses.

� I recommend the WINS Academy Programme to my colleagues with accountabilities for nuclear security.

I recommend the WINS Academy Programme to my colleagues with accountabilities for nuclear security.

14

Our Knowledge Centre provides a wealth of information on nuclear security, including 36 International Best Practice Guides (BPGs), numerous special reports, webinars and more.

2017 in Numbers

Total number of publications downloaded: 6,897

Most frequently downloaded BPGs in 2017:

1.4 Nuclear Security Culture

1.5 Security Performance Metrics

5.4 Security of Radioactive Sources used in Medical Applications

Distributed publications in 2017: 1500+

Revised BPGs:

1.1 Effective Security Regulation

3.6 Nuclear Security Armed Guard Force: Recruitment and Training (combined former BPGs numbered 3.6 and 3.7)

5.4 Security of Radioactive Sources used in Medical Applications

New BPGs:

3.8 Countering Homegrown Violent Extremism and Insider Threats in the Nuclear Sector: Mitigation Strategies

5.6 Peer Review Guidelines to Assess the Security of Radioactive Sources Used in Medical Applications

Revised special report:

Considerations for the Adoption of Alternative Technologies to Replace Radioactive Sources

New special report:

ISO 29990:2010 Implementation Handbook

Knowledge CentreWINS SUITE OF SERVICES

15

Training and CertificationThe WINS Academy offers the world’s first international training and certification programme for people who have responsibilities for the management of nuclear security. The programme is based on a core philosophy that views security as a fundamental aspect of risk management and corporate reputation.

WINS Academy ProgrammeOur programme consists of a Foundation Module plus nine electives. All participants must first enrol in the Foundation Module and can then select the elective of their choice.

All modules use a problem-based approach to learning that is practitioner-focused, hands-on, cross-functional and immediately useful. Our goal is to ensure that the modules tell a compelling, well-researched story that speaks to an educated audience but avoids stilted bureaucratic or academic language. We also incorporate numerous case studies, exercises and questions for reflection to stimulate thinking and increase learning.

Every module requires approximately 40 hours of study and can be completed entirely online. Traditional hardcopy textbooks are also provided for each course.

Training and CertificationWINS SUITE OF SERVICES

Cyber SecurityComing soon

Communicating with Civil

Society

Nuclear Security Incident

Management

Transport Security

Management

Nuclear Security Programme

ManagementNuclear Security

Regulation

Radioactive Source

Security Management

Nuclear Security Governance Coming soon

Nuclear Security for Scientists,

Technicians and Engineers

FoundationModule

STE training in Vienna, 2017

16

Training and Certification

Enrolment & CertificationThe WINS Academy has grown to over 1,000 participants. As of 31 December 2017, we had 288 Certified Nuclear Security Professionals (CNSPs) from 36 countries. Certification exams are delivered in partnership with Pearson VUE, the world’s largest testing and assessment provider.

Training in 2017 In 2017, the WINS Academy increasingly provided blended learning opportunities through in-person training courses that focus on specific WINS Academy modules. Such training enables participants to interact face-to-face with others who are studying the same module and to delve more deeply into the subject matter than would be possible when they are studying completely on their own. The training courses also give participants the opportunity to sit for the certification exam at the end of the course.

2017 Training Highlight Strengthening Radioactive Source Security in Mexico and Central America through Collaboration, Training and Certification.

In 2016, the Government of Canada signed an agreement with the Government of Mexico in which Canada agreed to contribute to the development of a sustainable and certified nuclear security training centre to support Mexico’s commitment to INFCIRC/901. One of the results of the agreement is that it enabled WINS to contribute its technical expertise to SENER and its National Institute for Nuclear Research (ININ) by collaborating on a range of professional development services between September 2016 and March 2018.

WINS SUITE OF SERVICES

Our training course on Strengthening Radioactive Source Security in Mexico City

17

Between March and November 2017, WINS delivered one national and two regional training courses on radioactive source security, as well as one national workshop on the transport of radioactive sources.

As a result of this project, the Foundation Module and the elective modules for Radioactive Source Security Management and Transport Security Management have been translated into Spanish and are now available on the WINS Academy Learning Management System.

WINS also assisted ININ with matters related to ISO 29990 certification. ININ is currently finalizing the alignment of its procedures and practices with ISO 29990 requirements and will undergo a certification audit in March 2018.

Quotes from the Mexico project:

“ I learned how important security is, as well as the responsibilities that institutions, society and individuals have for security.”

“ I particularly valued the interactions between different institutions and the willingness of participants to share their experiences.”

Our training course on Strengthening Radioactive Source Security in Mexico City

“ I especially liked hearing about the experiences of the participants and the instructors. Their anecdotes were really illuminating.”

18

WINS Academy AlumniWe published our first Certified Nuclear Security Professional (CNSP) Career Report in 2017. The statistics used in the report were based on surveys that asked Alumni questions about why they had sought WINS Academy certification, how certification has benefited them both personally and in the workplace, and how they are currently implementing and integrating what they have learned into their professions.

Following are some examples of the results:

Training and CertificationWINS SUITE OF SERVICES

96%say that WINS certification has had a positive impact on their professional image/reputation.

50%received a significant increase in responsibility since they became

certified.

19

Academy Quotes:

“ The application of a nuclear security programme is a multi-faceted challenge. The wins academy provides various best practices and strategies to meet those challenges while encouraging the user to benchmark their own security arrangements with the course content. I have found this to be an extremely valuable source of knowledge and strongly recommend others to achieve certification.”

– Chris Clark, Security Program Authority, Canadian Nuclear Laboratories

“ I feel the impact of WINS academy certification in my career. It will definitely bring changes and transformation in my organisation’s approach towards effective and sustainable implementation of nuclear programmes/activities.”

– Dr Jackson Dunah Abafoni, Nigeria Atomic Energy Commission, Nigeria

Ambassador ProgrammeWINS launched the Academy Ambassador Programme in autumn 2016. Its purpose is to identify WINS alumni in locations around the world who are particularly enthusiastic about the Academy and the value they

have experienced from it and who would like to encourage Academy participants in their countries to complete the programme and become certified as well. As of December 2017, we had 11 Ambassadors from the following countries: Brazil, France, India, Jordan, Morocco, Nigeria, Romania, Serbia and South Africa.

Scholarship ProgrammeWe have scholarships available for selected participants who come from certain countries and who have specific responsibilities for nuclear security related to the certification programme.

Academy Quote:

“ I firmly believe the WINS certification programmes will help change perceptions towards nuclear security and will lead to greater security globally as more and more people enrol and build competence in their areas of responsibility.”

– Raymond Agalga, Ghana

F I N D O U T M O R E A T

W W W . W I N S . O R G / S C H O L A R S H I P S

20

Our evaluation services provide organisations with the tools they need to assess the maturity of their security arrangements, measure the effectiveness of their security culture, and identify areas needing improvement.

Self-Assessment ToolsIt is essential to evaluate and measure security programmes, processes, plans and more. This is why all of our International Best Practice Guides include practical self-assessment questionnaires directed at such stakeholders as the board, executive management, security management and regulators. They also include a Security Management Maturity Scale consisting of five different levels of organisational achievement for security. When stakeholders benchmark where they fall on this scale, they are able to identify possible gaps in their security infrastructure; this gives them a starting point for improvement.

Peer ReviewIn 2017, one of our staff spent a month on secondment at the World Association of Nuclear Operators (WANO) to learn more about WANO’s approach to conducting safety peer reviews. He also participated in a Corporate

Peer Review that WANO conducted in Endesa, Spain. We incorporated what could be applied to nuclear security peer review in an Implementation Handbook for Assessing the Corporate Oversight of Nuclear Security that examines the options, opportunities and constraints associated with conducting nuclear security peer reviews. (We plan to pilot the handbook’s guidelines in 2018 and would like to thank WANO for its considerable support and assistance.)

EvaluationWINS SUITE OF SERVICES

PHOTO

21

Quality Management system In December 2017, WINS management systems are ISO 9001 certified and our learning services are ISO 29990 certified. This accomplishment demonstrates our commitment to providing the highest quality services to our members and to careful stewardship of our funding.

Because we believe that excellence and quality should be determined by external measurements, not simply by self-assessment, we proactively seek audits from external organisations on the quality of our services and financial management. This is also why we value feedback from our members and other stakeholders so highly.

Support Processes

22

WINS launched its new website on 1 November 2017. The purpose of the complete redesign was to present the WINS story in a clearer, more effective way and to make it easier for visitors and members to navigate the site and find what they are looking for. We also completely revised the backend to improve the efficiency and effectiveness of our internal processes. For example, we migrated multiple databases into one central database, thereby creating an organised system that much more efficiently manages WINS membership, events, Academy enrolment and reporting.

And our members have taken note. The results of a survey conducted after the launch indicate that 98% of our members prefer the new website to the old one!

At the same time that we launched the new website, we also launched our own Storefront, enabling individuals and organisations to purchase Academy programmes directly from the WINS Store. This means that the registration process for Academy courses has been greatly simplified and streamlined.

The next stage of this process is to implement a single sign-on to ensure that the administrative process is seamless for our users—from accessing the eLearning

material on the platform to registering for exams. (We anticipate that this feature will be ready by April 2018.)

In parallel with the redesign of our website, WINS also undertook a process to revision our brand identity. Our publications and marketing materials are now being redesigned to reflect our brand’s new look and feel.

Website & Communication

98%of members prefer the new website

23

The New WINS website

Our Knowledge Centre

V I S I T O U R W E B S I T E A T

W W W . W I N S . O R G

24

Financial Performance

Our financial arrangements are based on a system of strict allocation of expenditure as well as time allocation for every staff member, so that we control our time and associated costs to a high standards. Our overall level of unrestricted funds for corporate development ended the year slightly lower because

of investments in our management systems and stakeholder engagement. Our 2017 accounts were independently audited by Deloitte in March 2018 and found to be fully satisfactory. Our financial position at the end of 2017 and the allocation of funding to different activities are shown below:

WINS Assets (A) €4,122,335

Restricted funding for programme deliverables €3,040,610

Unrestricted funding for strategic development €132,336

Outstanding liabilities and provisions €912,789

Total liabilities (L) €4,085,735

Operating reserves (A-L) €36,600

Overview of Income and Expenditure in 2017

Income from delivered programme €3,218,229

Corporate donations, memberships, and other income €182,271

WINS Income: €3,400,499

WINS Expenditure: €3,133,688

25

Activity related expenditure distributionIn 2017, we allocated over 82% of our annual operating budget to the WINS programme and stakeholder engagement; the balance was used for WINS support processes.

66%

18%

16%WINS Programme

Support Processes

Stakeholder Engagement

26

The WINS Team

Although WINS started and finished 2017 with 13 staff members, a few changes in personnel took place.

Rhonda Evans joined WINS in August as Head of the WINS Academy, and Anida Čeliković joined in October as Administration Assistant. Dan Johnson returned to the United States at the end of September, exchanging his role as a staff member to one as a Senior Adviser (consultant) to WINS. We were also delighted to host Graham Hemingway for a period of three months under the UK Office for Nuclear Regulation Graduate Secondment Programme and hope to extend the number of graduate interns in future years.

WINS Staff at the end of 2017:

Ingrid Kirsten Stakeholder

Liaison Manager

Dr. Roger Howsley WINS Executive Director

Pierre Legoux Head of Programmes

Rhonda Evans Head of the

WINS Academy

Vesna Gradt Head of Finance and

Development

27

Jadallah Hammal Programme Manager

Raquel Delgado Project Manager

Amanda Kratochvil WINS Academy & Communications

Anida Čeliković Administration Assistant

Clarice Dankers Learning Technologist

Aleksandra Žilić Financial Project

Controller

Bettina Lock Office Manager

Anubhav Shrivastava Information Technology

Specialist

28

2018 Targets

P Expand the Board of Directors and revise the Statute and Board Governance Manual by Q2.

P Conduct at least 15 international events in 2018 to support the 2020 Strategic Objectives.

P Publish the WINS Academy Cybersecurity module in Q2.

P Publish the revised WINS Academy Governance and Executive Management Elective in Q2.

P Produce two new certified courses on Radioactive Source Security Management by Q4.

P Produce and Publish the 2nd WINS Alumni Career Report in Q3.

P Publish the Special Report on Corporate Governance Arrangements for Nuclear Security in Q1.

29

P Publish the interim report on the Benchmarking Study on Aviation and Nuclear Security in Q3.

P Launch the Gender Champions’ programme in Q2.

P Achieve 1,500 participants and 600 graduates in the WINS Academy programme by the end of 2018.

1,500 15WINS Academy participants by

the end of 2018International events

in 2018

Achieve Conduct at least

30

Funding Organisations

The organisations below represent all past and current WINS funders.

31

E D U CAT I O N PA RT N E R

Anonymous individual donors

The organisations below represent all past and current WINS funders.

2018 © World Institute for Nuclear Security (WINS) All rights reserved. Landstrasser Hauptstrasse 1, AT-1030, Vienna (Austria). Tel.: +43 1 710 6519 | Fax: +43 1 710 6519 20 | Email: info@wins.org | Website: www.wins.orgInternational NGO under the Austrian Law BGBI. Nr. 174/1992 | GZ: BMeiA-N9.8.19.12/0017-I.1/2010

WINS(18)10

Our VisionAll nuclear and other radiological materials and facilities are effectively secured by demonstrably competent professionals applying best practice to achieve operational excellence.

Our MissionTo be the leader in knowledge exchange, professional development and certification for nuclear security management.