That is correct. i work in nuclear material security and safeguards. For what I can say, which isn't much, it's the security of the material (HEU and Pu) that makes it hard to make a bomb. Its hard to enrich, and furthermore you need HEU or Pu. LEU won't get you a big boom. Without enough enrichment, no Bomb.
Theft and diversion is a big deal with Pu and HEU for this very reason. Which is why access to either has a two man rule. And because you can safely handle Pu and HEU,(its just an alpha and criticality hazard so unless you inhale or eat them, or you have bad geometry it's no big deal), that makes it vital that you carefully account for all of it. It won't kill the thief, and you don't need much Pu for a bomb.
Theft and diversion is a big deal with Pu and HEU for this very reason. Which is why access to either has a two man rule. And because you can safely handle Pu and HEU,(its just an alpha and criticality hazard so unless you inhale or eat them, or you have bad geometry it's no big deal), that makes it vital that you carefully account for all of it. It won't kill the thief, and you don't need much Pu for a bomb.