Last Update: August 19, 2023

In July NRPP was notified of a breach of the RMP (Radon Measurement Professional) and RMFT (Radon Measurement Field Technician) exam content. Accreditation to ISO/IEC 17024 requires us to maintain the security of our exams and in cases of suspected (or confirmed) exam content breaches we implement our exam security incident response plan. This plan requires us to do two things: 1. immediately suspend testing and 2. launch an investigation to determine the scope of the breach and establish the extent to which the content has been exposed.

We’ve completed our investigation. This update explains our implementation of NRPP’s security incident response plan and the findings of our investigation.

---

EXAM SUSPENSION UPDATE

Here’s what we did:

During the week of July 10 AARST leadership prepared to stop RMP/RMFT testing. We developed our plan and created communication pieces for our various stakeholders, including the AARST Board of Directors, NRPP Certification Council, the EPA, state radon programs, ANAB, AARST staff, and the public. The plan was reviewed and approved by the Certification Management Committee and we then suspended testing.

When an exam content breach is suspected or confirmed the certifying body’s response is to stop testing with the exposed exam form, and immediately create and release a back-up form. This would allow testing to proceed with no disruptions. Unfortunately, the NRPP did not have additional items (test questions) beyond those that are on the exposed exam so we were unable to create a back-up form to replace the breached one. In response we scheduled an emergency item development meeting with the goal of creating a new bank of items to (1) develop a replacement form so we can begin testing again, (2) allow us to create new forms in the future, and (3) respond immediately should another breach occur.

What is the status of the new test?

The RMP/RMFT item development meeting is scheduled for August 18 -20. A representative panel of individuals representing radon service providers and state radon programs is convening for three days to write, review, and approve new test items. At the conclusion of this meeting, we aim to have a bank of over 250 questions from which we can pull items to create new RMFT and RMP exams.

Following this meeting, and once the new items have been reviewed in our database, we will create the new exam forms and be ready to begin pilot testing them.

What is pilot testing?

Pilot testing allows us to “test” the items before using them as scored items on exams. We collect and analyze pilot item data to identify items that do not perform well (are too hard or do not discriminate between high and low ability candidates). Items that do perform well will then be used as scored items on the new, or future, examinations. Following this process helps to ensure that the exams are fair and that the scores are valid indicators of the candidate’s ability.

We will update this site once we have more information on when pilot testing will begin.

INVESTIGATION

Here’s what we did:

The goal of our investigation was to identify if the breach was real, the person(s) involved, and how the content was obtained, including who had access to the exam content and to what extent that content was shared. Specifically, we sought to determine whether exam content was shared within a particular group of individuals, within a particular course, within a particular training provider, within the entire training network, or with the public at large (posted online).

We did this through a variety of activities, and are pleased to report that, should the trainer-in-question have a copy of the exam its distribution was limited and did not prove to be advantageous to candidates. Although the whole situation is unfortunate, the last thing NRPP wanted to do was revoke the credentials of any certified professionals.

Investigation Results:

We were unable to confirm that the trainer-in-question has the exam or was attempting to distribute it.

We cannot determine whether the exam was shared during a course and do not know which students were involved.

We did not find evidence that any exam content was leaked to the internet

We have concluded that the incident was not an organized, widespread incident

• Exposure doesn’t appear to extend beyond the trainer-in-question
• The incident is unrelated to, and not supported by, the specific training provider
• The breach does not appear to involve NRPP’s entire trainer network
• Seeing exam content prior to the exam did not prove to be advantageous to that subset of examinees

A number of positives came out of this incident:

• We received overwhelming support from our candidates, certified professionals, trainers, and other stakeholders.
• NRPP’s Certification Management Committee and Certification Council, and the AARST Board of Directors have been supportive of rapid and decisive action
• The willingness of the professional community to drop everything and come to our support was unexpected. You should be proud to be a part of a profession that truly cares about the radon industry and values the NRPP credentials.
• The additional feedback we received about the certification process was what we needed to hear. We heard you – and thank you for being so honest about your experiences.
• Because of the comments we received, we have contracted with a new remote proctoring vendor and will begin testing with them when we launch the new exams.

What are you doing to make sure this doesn’t happen again?

Many of you have asked what we are doing to ensure this doesn’t happen again. We can’t guarantee it won’t, but we are taking steps to lessen the likelihood of it happening and taking measures to make sure we can respond quickly if it does:

• Our new remote proctoring procedures will discourage cheating and exam theft 
• Having a bank of questions will allow us to create a back-up exam form immediately, in the event there is another breach
• Item development will focus on assessing the essential knowledge required of measurement professionals
• We will be providing education on the certification process, how to best prepare, and how trainers can best support their students
• We will be tracking exam statistics more closely and looking for anomalies so that we can investigate and respond to any issues before having to take extreme action.