Information Notice 1986-91, Limiting Access Authorizations

Limiting Access Authorizations

ML031250123
Person / Time
Site:	Beaver Valley, Millstone, Hatch, Monticello, Calvert Cliffs, Dresden, Davis Besse, Peach Bottom, Browns Ferry, Salem, Oconee, Mcguire, Nine Mile Point, Palisades, Palo Verde, Perry, Indian Point, Fermi, Kewaunee, Catawba, Harris, Wolf Creek, Saint Lucie, Point Beach, Oyster Creek, Watts Bar, Hope Creek, Grand Gulf, Cooper, Sequoyah, Byron, Pilgrim, Arkansas Nuclear, Three Mile Island, Braidwood, Susquehanna, Summer, Prairie Island, Columbia, Seabrook, Brunswick, Surry, Limerick, North Anna, Turkey Point, River Bend, Vermont Yankee, Crystal River, Haddam Neck, Ginna, Diablo Canyon, Callaway, Vogtle, Waterford, Duane Arnold, Farley, Robinson, Clinton, South Texas, San Onofre, Cook, Comanche Peak, Yankee Rowe, Maine Yankee, Quad Cities, Humboldt Bay, La Crosse, Big Rock Point, Rancho Seco, Zion, Midland, Bellefonte, Fort Calhoun, FitzPatrick, McGuire, LaSalle, 05000000, Zimmer, Fort Saint Vrain, Shoreham, Satsop, Trojan, Atlantic Nuclear Power Plant, Skagit, Marble Hill
Issue date:	11/03/1986
From:	Jordan E NRC/IE
To:
References
IN-86-091, NUDOCS 8610290048
Download: ML031250123 (8)

SSINS No.: 6385 IN 86-91 UNITED STATES

NUCLEAR REGULATORY COMMISSION

OFFICE OF INSPECTION AND ENFORCEMENT

WASHINGTON, D.C. 20555 November 3, 1986 IE INFORMATION NOTICE NO. 86-91: LIMITING ACCESS AUTHORIZATIONS

Addressees

or

All nuclear power reactor facilities holding an operating license using or

construction permit, and fuel fabrication and processing facilities

possessing formula quantities of special nuclear material.

Purpose

of the weaknesses

This information notice is provided to alert licensees to some and safety. It is

in access control which could have an impact on public health

to

expected that the recipients will review the information for applicability

similar

their facilities and consider actions, if appropriate, to preclude contained in

problems from occurring at their facilities. However, suggestions

no

this information notice do not constitute NRC requirements; therefore, specific action or written response is required at this time.

Description of Circumstances

breaker

Some recent events involving threats to safety, for example unauthorized large

manipulation and misalignment of valves, have occurred at sites where

vital areas

numbers of personnel are granted unescorted access to a number of must be limited

and vital islands. 10 CFR 73.55(d)(7) clearly states that access access

to individuals who require such access to perform their duties. Granting and

to others for expediency or convenience increases the risk of sabotage perpetrators

vandalism by insiders and reduces the likelihood of identifying the

in followup investigations.

with

Two recent examples follow where access was not limited in accordance

10 CFR 73.55:

involving

1. In an Enforcement Conference, a licensee claimed that a condition because

two (2) unlocked and unalarmed vital area doors was not significant access to

all but six (6) of about 4000 people onsite had been authorized

the vital area.

been granted

2. At another site most of the administrative/secretarial staff had had been

access to a vital area because a spare word processing terminal

installed there.

8610290048

IN 86-91 November 3, 1986 As a result of these and other specific instances, an informal survey was

conducted of 18 sites in one NRC region. The data collected showed that 90

percent of the 28,000 active badges allowed access to at least one vital area

and more than 50 percent of the badges allowed access to all vital areas.

A review of the above cases showed that the licensee's programs did not address

specific criteria for establishing "need for access" to vital areas or the

equipment contained therein. In some cases, the plans or procedures simply

indicated that a member of management determines access authorization, but no

standard existed for what constituted need. In other cases management provided

overly broad and nonspecific criteria such as "emergency duties" or "work- related duties."

Discussion:

The above described circumstances are indicative of potential weaknesses in

security programs which could allow individuals access to vital equipment when

no supportable reason for such access exists. The root cause of this weakness

appears to be the lack of adequate criteria to clearly determine the circumstances

which must exist prior to allowing an individual free, unescorted access to

controlled areas of the plant.

While it is recognized that facilities differ, certain basic criteria should

be applied to determine the need for access. As noted in IE Bulletin 79-16 (copy attached), valid need should be based on the performance of specific tasks

on or associated with equipment located in each vital area to which access is

authorized. In addition, vital areas should exclude nonvital equipment and

activities to the extent possible to minimize the number of people requiring

access.

To minimize the number of people granted access, consideration may be given to

(1) removing or limiting unescorted access authorization for those with only

infrequent or administrative needs, and (2) removal of unescorted access

authorization when need no longer exists. In accordance with IE Bulletin 79-16, dated July 26, 1979, access lists should be reviewed every 31 days to eliminate

individuals whose need for access has expired. When only infrequent access is

required, escorted access authorization should be sufficient.

IN 86-91 November 3, 1986 information notice.

No specific action or written response is required by thiscontact the Regional

If you have any questions regarding this matter, please

office or the technical contact

Administrator of the appropriate NRC regional

listed below.

ran,d ir tor

Divisi of Emergency Preparedness

and Engineering Response

Office of Inspection and Enforcement

R. P. Rosano, IE

(301) 492-4006 Attachments:

1. IEB 79-16

2. List of Recently Issued IE Information Notices

UNITED STATES

NUCLEAR REGULATORY COMMISSION

OFFICE OF INSPECTION AND ENFORCEMENT

WASHINGTON, D.C. 20555 July 26, 1979 IE Bulletin No. 79-16

Description of Circumstances

An attempt to damage new fuel assemblies occurred recently at an operating

nuclear reactor facility. During a routine fuel inspection, the licensee

discovered that a chemical liquid had been poured over 62 of 64 new fuel

assemblies. Analysis indicates that the chemical liquid was sodium hydroxide, a chemical stored and used onsite.

The licensee stores new fuel assemblies in dry storage wells on the same

elevation as the spent fuel pool within the Fuel Building, a vital area.

Access to the building is controlled by use of a coded keycard which elec- portals. The licensee issues coded

tronically unlocks the alarmed personnel com- keycards to both licensee and contractor personnel after the successful

addition, licensee site manage- pletion of a background screening program. In keycard

ment-certifies monthly that each individual has the need for a coded building is

in order to perform required duties. Further access within'this

not limited by other barriers or controls.

several

As a result of this incident, an initial licensee audit determined that the

hundred licensee and contractor personnel had access to this area during

period when the attempt to damage the fuel was made. The audit also revealed recording

that one coded keycard reader at a vital area portal was inaccurately were

access data at the alarm station. Also discovered during this audit

indications of frequent "tailgating" on access through the portals. Tailgating

occurs when more than one person passes through a portal on one person's

authorized access. Their passage is therefore not recorded, and unauthorized author- persons could gain entry in this manner. Tailgating does not include

ized access controlled by an escort.

Discussion of Applicable Requirements:

sabotage

10 CFR .73.55(a) requires the licensees to protect against industrial

states that access

committed by an insider in any position. 10 CFR 73.55(d)(7) individuals who

to Vital Areas shall be positively controlled and limited to to perform

are authorized access to vital equipment and who require such access

their duties. Specific commitments implementing this regulation are described

in each licensee's approved Security Plan.

Attachment 1 IN 86-91 lovember 3, 1986 Paqe I of 4

• IE Bulletin No. 79-16 July 26, 1979 and

NRR, in their meetings with the licensees in March 1977 to explain £ 73.55 of

what would constitute an acceptable plan, explained that positive control

access to a vital area consisted of two elements: first, that the person

requesting entry has the necessary background screening and need toandperform second, Job related functions to be authorized access to that Vital Area, func- that he has a need at that specific time to enter to perform a specific

tion. This is comparable to gaining access to a classified document; you need

both a clearance and a need to know.

would

In approving security plans, NRR assumes that the determination of need should

be based upon a valid need and not convenience. Furthermore, access reason- be authorized to a minimum number of people, and licensees should use

able alternatives to minimize the number of personnel and frequency of access.

Acceptance Criterion 5.B of the Security Plan Evaluation Report (SPER)

Workbook, dated January 1978, states that the licensee must commit to pro- viding positive access control to Vital Areas by:

1) Limiting access to authorized personnel.

2) Requiring positive identification prior to entry.

3) Requiring an established need for access.

4) Maintaining records of entry, exit and reason for entry.

5) A system for control within the Vital Area.

NRR Review Guideline #21 suggests that blanket access authorizations should

method of indicating the Vital

not be granted by stating that an acceptable to

of each vital

Areas to which access is authorized includes a record encoded to permit access area

which the holder is authorized access, and the card is

to only those Vital Areas to which the individual has -been granted access.

person

Review Guideline 123 states that for access to a Type I Vital Area, the individual

must be authorized entry by the shift supervisor or other designated in the Type I

who has been informed of the estimated length of time to be spent

Vital Area.

and the

There needs to be some balance attained between operational necessity entry is to

administrative burden of validating the need for access each time to all

be afforded. Many licensees grant "permanent access authorization"

of the frequency or dura- persons requiring access to vital areas, regardless and guidelines from NRR

tion of the need. This is contrary to the regulations

cited above.

Attachment 1 IN 86-91 November 3, 1936 July 26, 1979 IE Bulletin No. 79_16 Action to be Taken by Licensee:

1. Establish criteria for granting unescorted access to each vital area, which shall be based upon the following:

a. A screening program meeting ANSI N18.17. -

contained

b. The individual has a valid need for access to the equipment need is based

in each vital area to which access is authorized. Valid

tasks upon

upon assigned duties requiring the performance of specific

vital area to

or associated with specific equipment located in each

which access is granted. Valid need to enter one vital area shall

not necessarily indicate that the person has a need to enter any other

vital area.

days.

2. An access list will be established for each area not to exceed 31 list only for the duration of the

An individual will be on the access

has a valid need for unescorted

task to be performed. If an individual

this

access for a single entry or for intermittent occasions during

prepared. All access

period, a separate daily access list shall be

or his

lists shall be approved by the station manager (or equivalent)

designated representative.

upon

3. Individuals, will be removed from the access list immediately area

termination of need. If an individual has not entered the vital

during the effective period of the access list (not to exceed 31 days)

the need for access should be reassured prior to extending the authoriza- be

tion. To ensure that these actions are taken, the access list shall

reviewed and reapproved at least every 31 days.

the criteria

4. Void access authorizations for all personnel not satisfying and reissue

in lafb and where appropriate, reprogram the key card system

authori- key cards that are coded to implement the above vital area access

zation program.

of access

5. Develop reasonable alternatives so that the number and frequency

to vital areas can be minimized consistent with safe operations.

additional

6. Establish emergency procedures where, during an emergency, throughout

authorized personnel, meeting criteria in la&b, can move freely

Upon securing

the vital areas with their entry and exit being recorded. and normal access

from the emergency, the entry/exit record will be reviewed, control will be reestablished.

7. Prevent tailgating by one or more of the following:

Attachment I

IN 86-91 Aovember 3, 1986 IE Bulletin No. 79-16 July 26, 1979 a. Establish procedures that require authorized personnel to prevent

other-personnel, including those authorized unescorted access, from

tailgating. Ensure all authorized personnel are trained in the proce- proce- dure, and establish a management program that ensures that the

dure is properly performed.

b-. Acquire equipment, such as turnstiles, to prevent tailgating. Ensure

that such equipment will not deny access or egress under emergency

conditions.

c. Station a guard, watchperson or escort at the vital area access portal.

This alternative would be most useful when there is a large number and

frequency of access, such as occurs with containment during refueling.

d. By any other means that achieve this objective.

8. Assign corporate responsibility for management oversight of VA access

control and require personal involvement to ensure that all intermediate in

levels of management are properly discharging their responsibilities

this regard.

Conduct routine functional tests of the electronic access control system,

9. and proper

including each key card reader, to verify (i) its operability

of the data recorded. This test should

performance, and (ii) the accuracy 73.55(g).

be incorporated into the seven-day test required by 10 CFR

an operating

10. Report in writing within 45 days (for facilities with (including

license) the actions you have taken and plan to take a

should be submitted

schedule) with regard to Items 1 through 9. Reports should

to the Director of the appropriate NRC Regional Office and a copy Division of

be forwarded to the NRC Office of Inspection and Enforcement, Safeguards Inspection, Washington, D.C. 20555.

Approved by GAO, B180225 (R0072); clearance expires 7-31-80. generic Approval was

problems.

given under a blanket clearance specifically for identified

Attachmtont 1 IN 86-91 November 3, 1986 Attachment 2 IN 86-91 November 3, 1986 LIST OF RECENTLY ISSUED

IE INFORMATION NOTICES

Information Date of

Notice No. Subject Issue Issued to

Requests To Dispose Of Very 11/3/86 All power reactor

86-90 facilities holding

Low-Level Radioactive Waste

Pursuant to 10 CFR 20.302 an OL or CP

Uncontrolled Rod Withdrawal 10/16/86 All BWR facilities

86-89 holding an OL or CP

Because Of A Single Failure

Main Steam Safety Valve Test 10/16/86 All power reactor

86-05 facilities holding

Sup. 1 Failures And Ring Setting

Adjustments an OL or CP

Traceability And Material 10/15/86 All power reactor

86-25 facilities holding

Sup. 1 Control of Material And

Equipment, Particularly an OL or CP

Fasteners

Compensatory Measures For 10/15/86 All power reactor

86-88 facilities holding

Prolonged Periods Of Security

System Failures an OL or CP; fuel

fabrication and

processing facilities

Loss Of Offsite Power Upon An 10/10/86 All power reactor

86-87 facilities holding

Automatic Bus Transfer

an OL or CP

Clarification Of Requirements 10/10/86 All registered users

86-86 of NRC certified

For Fabrication And Export Of

Certain Previously Approved packages

Type B Packages

Enforcement Actions Against 10/3/86 All NRC medical

86-85 licensees

Medical Licensees For

Willfull Failure To Report

Misadministrations

Rupture Of A Nominal 9/30/86 All NRC medical

86-84 institution licensees

40-Millicurie Iodine-125 Brachytherapy Seed Causing

Significant Spread Of

Radioactive Contamination

OL - Operating License

CP = Construction Permit