10 CFR Part 73 vs. Part 74: Physical Protection vs. Material Control & Accounting

The business problem

Part 73 (Physical Protection of Plants and Materials) and Part 74 (Material Control and Accounting of Special Nuclear Material) both fall under the general "security" umbrella and are often discussed together — which leads some organizations to assume that strength in one implies strength in the other. They actually protect against different failure modes. Part 73 addresses unauthorized physical access, sabotage, and theft attempts against the facility and its materials. Part 74 addresses the possibility that special nuclear material could be diverted, lost, or unaccounted for — even without any physical breach at all.

Why it matters

Treating them as one program means a facility can genuinely excel at perimeter security, intrusion detection, and armed response, and still have a material control and accounting program that couldn't detect a diversion until a routine inventory reconciliation caught it, potentially much later than the event itself.

Signs the organization should pay attention now

• Physical security and material control & accounting are managed by the same team with no distinct programs, budgets, or reporting lines
• Material balance reconciliations happen on a fixed calendar rather than being triggered by any specific control weakness
• No one can describe, specifically, how the organization would detect a diversion that didn't involve a physical security breach
• Physical protection investments have grown while MC&A tooling and reconciliation cadence haven't been revisited in years
• Executive reporting covers physical security metrics but rarely, if ever, addresses material accounting confidence separately

What good looks like

The organization maintains genuinely separate physical protection and material control & accounting programs, each assessed on its own terms, with executive reporting that distinguishes "no one got in" from "everything is still accounted for" — rather than folding both into one general security line.

Practical guidance

Confirm the two programs have distinct ownership and reporting lines. Run each specific free assessment — Physical Protection and Material Control & Accounting — rather than a single combined self-check. And make sure executive reporting names both programs separately, rather than compressing them into one "security is fine" line.

My CISO Partner's perspective

We assess these as two distinct programs from the start, because collapsing them into one conversation is exactly how a strong perimeter ends up masking a weak accounting process.

Where to go from here

If executive reporting only ever says "security is fine" without distinguishing physical protection from material accounting, that single line is hiding two very different risk pictures.