RIS 2006-12, Us Nuclear Regulatory Commission. NRC Regulatory Issue Summary 2006-12; Endorsement of Nuclear Energy Institute Guidance Enhancements to Emergency Preparedness Programs for Hostile Action.

Us Nuclear Regulatory Commission. NRC Regulatory Issue Summary 2006-12; Endorsement of Nuclear Energy Institute Guidance Enhancements to Emergency Preparedness Programs for Hostile Action.

ML072670421
Person / Time
Site:	Oyster Creek
Issue date:	07/19/2006
From:	NRC/NRR/ADRA/DPR
To:	Office of Nuclear Reactor Regulation
References
2130-07-20506, TAC MC7624 RIS-06-012
Preceding documents:	ML061530290 (19 July 2006)
Download: ML072670421 (49)

UNITED STATES

NUCLEAR REGULATORY COMMISSION

OFFICE OF NUCLEAR REACTOR REGULATION

WASHINGTON, DC 20555-0001 July 19, 2006 NRC REGULATORY ISSUE SUMMARY 2006-12 ENDORSEMENT OF NUCLEAR ENERGY INSTITUTE GUIDANCE

"ENHANCEMENTS TO EMERGENCY PREPAREDNESS PROGRAMS

FOR HOSTILE ACTION"

ADDRESSEES

All holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.

INTENT

The U.S. Nuclear Regulatory Commission (NRC) is issuing this regulatory issue summary (RIS)

to endorse the Nuclear Energy Institute (NEI) guidance entitled "Enhancements to Emergency Preparedness Programs for Hostile Action," dated May 2005 (revised in November 18, 2005).

The NRC finds this document to contain an acceptable implementation methodology for licensees to apply in adopting the program enhancements discussed in NRC Bulletin 2005-02,

"Emergency Preparedness and Response Actions for Security-Based Events." This RIS

requires no action or written response by addressees.

BACKGROUND INFORMATION

Nuclear power plant emergency preparedness (EP) programs are designed to address a wide range of event scenarios. After the terrorist attacks of September 11, 2001, NRC evaluated the EP planning basis to ensure it continued to protect the public health and safety in the current threat environment. In 2002, NRC issued Orders requiring compensatory measures which include nuclear security and EP. The NRC staff has reviewed all of the responses to these

2002 Orders. The NRC staff has observed licensee performance during security-event-based EP drills and exercises and security force-on-force exercises. The NRC staff has discussed.

security-related EP issues with Federal, State and local government officials and with licensees.

The NRC staff determined that the EP planning basis continues to protect public health and safety, however, the NRC staff recognizes that enhancements are desirable to ensure effective plan implementation during security-related events. Examples of such enhancements include more timely NRC notification, improvement to onsite protective actions and revision of emergency action levels to identify security-related emergencies more succinctly.

The NRC staff issued NRC Bulletin 2005-02 on July 18, 2005, to obtain information from licensees on progress in implementing security-event-related EP program enhancements. The NRC staffs evaluation of licensee responses to the bulletin indicate that all licensees are considering or have implemented enhancements to their programs. NEI developed the enclosed guidance, entitled "Enhancements to Emergency Preparedness Programs for Hostile Action" (May 2005, revised November 18, 2005), to clarify the various options available to licensees to implement these enhancements, and NEI also requested NRC endorsement of these options in a letter dated November 22, 2005.

.SUMMARY OF. ISSUE

The NEI guidance clarifies issues, enhances emergency action levels, and provides implementation methods in support of Bulletin 2005-02. The NRC staff finds that the NEI

guidance remains consistent with the intent of the bulletin and is appropriate for licensee use.

As such, the NRC staff endorses this NEI guidance document with the following clarifications:

1. The NRC staff recognizes the need for the U.S. Department of Homeland Security (DHS) to be involved in the review and endorsement of proposed enhancements to the drill and exercise program that impact the demonstration and evaluation of offsite response organization capabilities in response to a security event-based scenario. In coordination with DHS, the NRC staff will evaluate changes to the scenario scope or extent of play for the proposed security event-based EP biennial exercise after NEI

submits forthcoming industry guidelines for the development of EP drill and exercise threat-based scenarios. Licensees are not expected to schedule security-based biennial exercises until NRC endorses, in coordination with DHS, forthcoming industry guidelines and completes revisions to regulation and guidance, as deemed applicable.

2. Attachment 4 ("Example Tools for the Development of Onsite Protective Actions") to the NEI guidance states in the discussion of possible actions, that the phrase "take cover" is an action intended to allow the use of an immediately available structure to provide personnel protection. These structures should be in designated locations that are located away from potential target buildings as discussed in NRC's Safeguards Advisory for Operating Power Reactors (SA 05-02). In addition, the examples of the protective action decision-making tools also should provide site-specific guidance for these locations.

3. Attachment 5 ("Integration and Demonstration of Emergency Response Security Events') to NEI guidance expects that over a 3-year period, each site will initiate an integrated drill, using a security event-based scenario, during a year when the licensee

• does not have to. demonstrate a biennial EP exercise in accordance with Appendix E to Title 10 of the Code of FederalRegulations (10 CFR) Part 50. However, the project timeline in Attachment 5 incorrectly specifies this period as July 2006 through December

2008, which is only a 30-month period. Based on discussions with NEI, the appropriate period for conducting site integrated drills is from September 2006 through August 2009 to allow the opportunity for NEI to provide further guidance and training to industry. Licensees using the NEI guidance to change their emergency plans should ensure that plan changes are coordinated with offsite response organizations. Although the NEI guidance provides an acceptable method for implementing enhancements, licensees may select other methods. If licensees adopt the changes as written in Bulletin 2005-02 and the NEI guidance, the NRC staff believes that those changes, on their own, would likely not pose a decrease in effectiveness and could be performed under 10 CFR 50.54(q) without prior NRC approval.

However, licensees have the responsibility to ensure that changes do not decrease the effectiveness of the emergency plans and that the changed plans continue to meet the standards of 10 CFR 50.47(b) and the requirements of Appendix E to 10 CFR Part 50. The NRC staff recognizes that other methods for implementing the enhancements also may be acceptable, but note that licensees should review these methods to ensure they do not decrease the effectiveness of the emergency plans. Without application to and approval by the NRC, licensee may not implement proposed changes that decrease the effectiveness of the approved emergency plans.

BACKFIT DISCUSSION

This RIS endorses NEI guidance entitled "Enhancements to Emergency Preparedness Programs for Hostile Action", revised November 2005, as an adequate methodology to implement the enhancements discussed in Bulletin 2005-02. Any action on the part of licensees to use the guidance, endorsed by this RIS is strictly voluntary. This RIS neither imposes any new or modified NRC staff requirements, nor prescribes a unique way to comply with the regulations, nor does it require any action or written response. Therefore, this RIS is not a backfit under 10 CFR 50.109 and the NRC staff did not perform a backfit analysis.

CONGRESSIONAL REVIEW ACT

This RIS is a rule as designated by the Congressional Review Act (5 U.S.C. §§ 801-808) and, therefore, is subject to .the Act.

FEDERAL REGISTER NOTIFICATION

A notice of opportunity for public comment on this RIS was published in the FederalRegister

(71 FR 12716) on March 13, 2006. Comments were received from the public and comment resolution can be found in the Agencywide Documents Access and Management System under Accession No. ML061510364.

PAPERWORK REDUCTION ACT STATEMENT

This RIS does not contain information collection requirements that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing collection requirements under

10 CFR Part 50 were approved by the Office of Management and Budget (OMB), approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, an information collection unless the requested document displays a currently valid OMB control number.

CONTACT

Please direct any questions about this matter to one of the technical contacts listed below.

IRA/

Ho K. Nieh, Acting Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation Technical Contacts: Michael B. Norris, NSIR/DPR Joseph D. Anderson, NSIRPDPR

(301) 415-4098 (301) 415-4114 E-mail: mbnO~nrc..qov E-mail: jdal@nrc.gov Enclosure: NEI Guidance, "Enhancements to Emergency Preparedness Programs Hostile Action", May 2005 (revised November 18, 2005) (Agencywide Document Access and Management System (ADAMS) Accession No. ML053290326)

Note: NRC generic communications may be found on the NRC public Web site, http://www.nrc.qov, under Electronic Reading Room/Document Collections.

CONTACT

Please direct any questions about this matter to one of the technical contacts listed below.

IRA!

Ho K. Nieh, Acting Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation Technical Contacts: Michael B. Norris, NSIR/DPR Joseph D. Anderson, NSIR/DPR

(301) 415-4098 (301) 415-4114 E-mail: mbn*,nrc.qov E-mail: ida1(nrc..ov Enclosure: NEI Guidance, "Enhancements to Emergency Preparedness Programs Hostile Action", May 2005 (revised November 18, 2005) (Agencywide DocumentAccess and Management System (ADAMS) Accession No. ML053290326)

.Note: NRC generic communications may be found on the NRC public Web site, http://www.nrc.cqov, under Electronic Reading Room/Document Collections.

DISTRIBUTION:

RIS File ADAMS ACCESSION NUMBERS:

PACKAGE: ML061530299. RIS: ML061530290. ENCLOSURE: ML053290326 ITAC M68203*

OFFICE DPR:NSIR Tech Editor TL:DPR:NSIR BC:DPR:NSIR DD:DPR:NSIR D:DPR:NSIR

NAME MNorris HChanl * JAnderson EWeiss NMamish ELeeds DATE 06/01/2006 06/07/2006 06/01 /2006 06 / 05/20061 06/07/2006 06/09/2006 OFFICE BC:ITSB:DIRS D:DORL OE OGC (SBREFA) OGCZNLO) PMAS

NAME TKobetz CHaney DSolorio NSanchez STreby JHarves DATE 06 / 22/20061 06/28/2006 1 06/27/2006 07 / 12 /2006 07/12/2006 06/28/2006 OFFICE 0IS LA:PGCB:DPR:NRR PGCB:DPR:NRR BC:PGCB:DPR:NRR D:DPR(A):NRR

NAME MJanney CHawes AWMarkley CJackson HNieh DATE 06 / 28/2006 38882 07/12/2006 07/18/2006 07 /19/2006 OFFICIAL RECORD

COPY

Enhancements to Emergency Preparedness Programs For Hostile Action May 2005 (Revised November 18, 2005)

While the NRC has concluded that the regulatory bases of Emergency Preparedness remain valid, appropriate enhancements have been identified for Nuclear Plant Emergency Preparedness Programs in response to hostile actions. Significant enhancements to Emergency Preparedness Programs have already been implemented through NRC Orders and initiatives as well as licensee voluntary actions. However ongoing analyses. have shown the need for further enhancements. These

.enhancements were outlined in NRC Bulletin 2005-02, "Emergency Preparedness and Response Actions for Security-Based Events", dated July 18, 2005. The purpose of this White Paper is to:

• Clarify proposed enhancements to NPP emergency plans as provided in NRC

Bulletin 2005-02.

" Provide implementation guidance for those enhancements.

• Acquire NRC endorsement of the proposed actions and implementation guidance.

Changes to emergency plans and procedures made in accordance with this guidance have been assessed and are not considered a decrease in effectiveness and may be performed without prior NRC approval in accordance with 10 CFR 50.54(q).

This paper provides enhancements in the following areas:

A. Emergency Classification Schemes for Hostile Action Related Events B. Accelerated NRC Call C. Protective Measures for Onsite Personnel D. Emergency Response Organization Augmentation E. Integrated Emergency Preparedness/Security Drill Program This paper does not address changes in offsite actions. Such changes, while contemplated, will be coordinated through an integrated review and interactions with the NRC, FEMA, licensees, and the Offsite Response Organizations (OROs). Additionally, impacts on offsite agencies as a result of the above enhancements will also be coordinated with the impacted agencies.

Page 1

A. Emergency classification schemes for hostile action related events Emergency plans should be revised to adopt modifications to the emergency classification schemes in two areas, the emergency classification level (ECL)

definitions and the emergency action levels (EALs). If licensees adopt the changes as written, the following enhancements to. emergency classification schemes would probably not pose a decrease in effectiveness to the licensee's emergency plan and

-could be implemented under 10 CFR 50.54(q) without the NRC's prior approval.

The changes to the ECL definitions specifically incorporate the hostile action component and written in Attachment 1, "Emergency Classification Level Definitions." Emergency plans and procedures should be modified to adopt the new ECL definitions.

A definition for HOSTILE ACTION and HOSTILE FORCE required to consistently implement the new EALs irrespective of scheme is provided in Attachment 2.

0 To ensure an appropriate level of response to a hostile action security-based event at an NPP, new security EALs should be added and existing security EALs revised in emergency plansand procedures as appropriate. Attachment 3,

"Enhanced Emergency Action Levels Implementation Guidance," contains the EAL changes in a general summary and in three separate formats suitable for EAL sets based on NUREG-0654, NUMARC/NESP-007, and NEI 99-01.

0 Licensees that currently have EAL submittals on the docket for NRC approval (i.e., submittals to convert from one scheme to another) will continue the amendment process and should incorporate the enhanced EAL scheme under

10 CFR 50.54(q) into their currently in use EALs. After NRC approval of the EAL

submittals, the enhanced EALs should be incorporated into the approved EALs in accordance with this white paper and then implemented.

a Licensees that submit EAL scheme conversion requests to the NRC for approval after issuance of this white paper should incorporate the enhanced security EALs into the new EAL scheme prior to submittal.

B. Accelerated NRC Call Existing Regulations in 10 CFR 73.71 require that the NRC be notified of security related events within one hour of the security event discovery. Additionally, 10 CFR

50.72 requires NRC notification "immediately after notification of the appropriate State or local agencies and not later than one hour after the time the licensee declares one of the Emergency Classes." In the event of coordinated attacks on multiple sites, these notification time requirements may not give the NRC sufficient Licensees are time to warn other NPP sites and notify other Federal agencies..

requested to change appropriate plans and procedures to ensure the NRC is called and notified of security related attacks within approximately 15 minutes from discovery of a security-based event. This initial NRC call is to be brief and minimal. It is understood that for declared emergencies many licensees currently await the arrival of augmenting staff to support NRC notification and reply to subsequent NRC

information requests. The purpose of this accelerated call is to allow the NRC to Page 2

warn other NPPs and initiate Federal response in accordance with the National Response Plan and does not replace the 10 CFR 50.72 NRC emergency classification notifications that are required after declaration of the security related EAL event. In support of this notification process, the NRC will not request an "open communications line". Additionally, the questions will be limited to information needed to understand which facility is involved and the nature of the event. The Nuclear Regulatory Commission is pursuing formal rulemaking via 10 CFR 73.71 to codify this change.

Utilities are requested to make the following changes in the accelerated call process:

A. The licensee should call the NRC using the emergency notification system (ENS)

line as soon as possible after being informed by the station security staff of any security-related event(s) considered to be a credible imminent threat or Hostile Action. The priorities are: safety and security of the plant; protection of plant*

personnel, protection of the health and safety of the public, and protection of the national infrastructure.

B. The accelerated call should be a verbal notification, with no hard copy, to the NRC with the following information:

• Site name

• Emergency Classification (if determined)

• Nature of the threat (if known, briefly described)

- Type of attack (e.g., armed assault by land or water, aircraft, etc)

- Attack status (i.e., imminent, in progress or repelled)

The call should not be -delayed to continue development or assessment of the event progress. Upon completion of the NRC call, the event should be assessed for applicability of the site-specific emergency plan emergency action levels. If appropriate, the event should be classified and the emergency plan implemented.

Appropriate emergency plan notifications to State and local emergency management authorities followed by the emergency plan notification to the NRC in accordance with 10 CFR 50.72 should then be performed. The accelerated call is not intended to satisfy or replace the emergency plan notification requirements. If the licensee has classified the event before the accelerated call, then the initial notification to the NRC per 10 CFR 50.72(a) (1) (i) will be considered met by the accelerated call.

Page 3

An example sequence of the accelerated call to meet the need to alert other critical infrastructure facilities is presented below:

Step Action

1 A security-based event considered to be an imminent threat to the security of the facility occurs or is discovered.

2 Security Supervisor directs notification of State and local law enforcement organizations so they can respond t the threat

3 Security notifies the Control Room of the occurrence

4 The Control Room Shift Manager(SM) is informed of the occurrence.

5 The SM directs the Control Room staff to implement imminent security threat procedures and take actions to use the ENS phone and contact the NRC Operations Center, making the accelerated call.

6 The SM assesses event for emergency declaration purposes.

7 The SM declares the emergency and initiates the emergency plan.

8 Notification to State and local authorities of event declaration.

9 Notification to NRC Operations Center is initiated, making the normal Emergency Plan notification The examples presented above are for illustrative purposes only. These examples are not intended to describe the exact or only sequence, rather they describe a preferred process of immediacy with regard to the "accelerated call" when addressing security-related events followed by implementation of the site's emergency plan, if appropriate. It is possible that the emergency classification and notification to offsite government officials will occur with or as the initial notification for assistance of local law enforcement. Notification of the NRC should occur immediately following notification of offsite officials and may be performed in an accelerated manner.

C. Protective. Measures for Onsite Personnel An Alert or Site Area Emergency declaration is generally accompanied by site assembly, accountability measures, site evacuation, activation of emergency response facilities (ERFs), and other actions. Although these actions are appropriate for some emergencies, other actions may be more appropriate for a hostile attack, particularly an airliner attack. Many licensees have made protective measure changes in response to the compensating measures imposed by the order of February 25, 2002, by modifying page announcements and emergency response organization (ERO) augmentation instructions.

Licensees should consider the following measures as part of a range of protective measures for site workers and apply them as appropriate, although they may not be suitable in all circumstances:

• Evacuation of personnel from target buildings (including security personnel)

• Site evacuation by opening (while continuing to defend) security gates

• Dispersal of licensed operators and/or key response personnel

• Onsite sheltering of personnel in structures away from potential site targets

• Arrangements for accounting for personnel after the attack Page 4

It is expected that site-specific arrangements, such as the location of workers in relation to potential targets, will dictate the appropriateness of sheltering versus evacuation. It should be noted that sheltering inside target buildings may not provide the intended personnel protection. Procedures should be modified to ensure plant page announcements accomplish the onsite protective measures deemed appropriate. Site-specific implementation of these actions would be considered sensitive information.

Licensees should consider developing an onsite protective measure.decision- making tool to help the shift manager/supervisor. This tool is intended to aid the rapid decision for site evacuation via a normal exit, site evacuation by opening gates, or if little time is available, locations for sheltering and buildings to be evacuated. The goal of this effort is to develop a simple decision making tool such as a flowchart, for the shift manager/supervisor to use in directing the site's protective measures. In any case, it may be appropriate to evacuate target buildings, as quickly as possible. The tool should be developed estimating the time needed versus time available to take action for the onsite population during:

• Normal working hours

" Off normal hours

" Weekends

• Outages

" Adverse weather Attachment 4 provides a template for and an implementation example of a suitable tool for shift manager decision making. However, site specific considerations should be incorporated such as:

• Potential target buildings and the proximity of shelter areas to them

• Possible approach paths for airliners may help identify suitable shelter buildings

• Structures between target buildings and shelter areas may provide additional protection

" Location of TSC and OSC with respect to target buildings dictates whether activation or assembly/sheltering elsewhere is appropriate

" Dispersion of control room and emergency response staff should consider protection of life as well as survivability of expertise necessary for nuclear safety after hostile action

" Warning of an armed attack is not likely, but should such warning be available, the attachment provides protective measures for consideration, however, these are not intended to replace the existing arrangements for protection of personnel when under an immediate attack.

Page 5

The proximity of near site assembly areas and the established alternative facility should be a site specific consideration, it may be appropriate to assemble response personnel in a building near the site but beyond the protected area rather than send personnel to a more remote alternative facility

• Even if there is little warning time of an airliner threat, it may be appropriate to avoid seeking shelter in target buildings D. Emergency Response Organization Augmentation The February 25, 2002 order to licensees required that licensees staff emergency response facilities and identify alternative facilities to support emergency operations.

facility (EOF) activities. Licensees have been inspected for compliance with this order and variations in the identification and staffing of emergency response facilities were found. Some licensees do not activate elements of the ERO until the site is secured.

Security based events warrant the activation of all elements of the ERO including operations and engineering support, corrective action and repair functions, medical and first aid response, and health physics support and monitoring and assessments. It is also prudent to activate the onsite staffers of the ERO and deploy them to an alternative facility near the site if there is time to safely relocate personnel. This includes the technical support center (TSC) staff, operations support center (OSC) staff, and any other ERO members assigned to onsite positions. The ERO is expected to be staged in a manner that supports rapid response to mitigate site damage as soon as the site is secured. It is appropriate for offsite facilities, such as ERO staging areas or offsite EOFs, to have general plant drawings and procedures, phones, and (ideally) computer links to the site. However, alternative facilities are not required to reproduce the full documentation present at primary emergency response facilities. Training centers, emergency operations centers, and enclosed assembly areas are adequate alternative facilities.

The characteristics of these alternative facilities should include:

" Accessibility even if the site is under threat of attack and therefore not accessible

• Communication links with the EOF, control room, and security

" Capability to notify offsite response organizations

• Capability for engineering and damage control teams to begin planning mitigative actions (e.g., general drawings and system information, or communications with ERO having access to procedures, general drawings, and plant information and are responsible to plan mitigative actions)

Many sites use the EOF as the alternative facility for onsite ERO members. This is acceptable when the EOF is outside the owner-controlled area and not far from the site. It is appropriate to identify an alternative facility near the site if the EOF is more than about 30 miles away. In cases where the EOF is located within the vehicle checkpoint, it is appropriate to develop an alternative facility for emergency response functions if the EOF is not accessible.

Page 6

E. Integrated Emergency Preparedness/Security Drill Program The likelihood for a security-based event at an NPP that causes damage to safety related equipment is low. However, emergency response organizations should be prepared to respond if such damage occurs. Assessments indicate that licensee measures are available to limit or mitigate the effects of security-based events.

Consequently, such events would not create an accident that causes a larger release or one that occurs more quickly than the accidents already addressed by the emergency preparedness planning basis.. However, security-based events pose aspects that are different from the usual condition traditionally practiced in EP drill and exercise programs. The ERO is the primary organization trained to effectively mitigate damage caused by a hostile action event. As such, the NRC believes that the ERO should practice response to security-based events.

The industry has proposed that an integrated Emergency Preparedness/Security Drill Exercise initiative be developed and implemented. Attachment 5 contains a detailed outline of the drill and exercise program as proposed by the industry.

Licensees are requested to make appropriate changes to the emergency plan to document these enhancements.

Attachments:

1. Emergency Classification Level Definitions

2. Definition for HOSTILE ACTION and HOSTILE FORCE

3. Enhanced Emergency Action Levels Implementation Guidance

4. Tools for the Development of Onsite Protective Measures

5. Integration and Demonstration of Emergency Response to Security Events,

"Integrated Response Exercises"

Page 7

Attachment I Emergency Classification Level Definitions Emergency Classification Levels (ECLs).

The following provides a revision to the description of the emergency classification levels (ECLs) to include a hostile action based perspective.

- Notification of Unusual Event Events are in process or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systems occurs.

- Alert Events are in process or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

- Site Area Emergency Events are in process or have occurred which involve an actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION

that results in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.

General Emergency Events are in process or have occurred which involve actual or imminent substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility, Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.

These revisions are based on the threat posed by hostile action events rather than current plant conditions. Nuclear accident. progression considers the unlikely occurrence of multiple failures and the defense-in-depth provided by plant design. The new ECL

definitions incorporate the intentional harm and destruction of a hostile action that could lead to a radiological release. Consequently, these descriptors and the EALs that follow are intended to be more proactive and to initiate response measures not previously considered. This is considered appropriate because of the nature and indeterminate magnitude of the potential for harm during hostile action events.

Page 8.

Attachment 2 Definition of HOSTILE ACTION

Definitions:

The following definitions are to be used consistently though out the security EAL

schemes.

HOSTILE ACTION

An act toward an NPP or its personnel that includes the use of violent force. to destroy equipment, takes hostages, and /or intimidates the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, projectiles, vehicles, or other.devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the NPP. Non- terrorism-based EALs should be used to address such activities, (e.g., violent acts between individuals in the .owner controlled area.)

HOSTILE FORCE

One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

Page 9

• Attachment 3 Enhanced Emergency Action Levels Implementation Guidance NUREG-0654 Guidance Modify the ECL definitions as provided above.

Add the definition for HOSTILE ACTION and HOSTILE FORCE as provided above.

Delete any existing ISFSI Security EAL because it is replaced by either HOSTILE

ACTION EAL or Site Attack EAL.

Replace existing NUREG-0654 General Emergency Example #3 (Loss of physical control of the facility) with NEI 99-01 HG1.

The following are the Security EALs for NUREG-0654 users. Verify that your EAL sets include the following Security related EALs:

The basis for these EALS is new guidance for attack events and Safeguards Advisory for Operating Power Reactors (SA 05 - 02). Training materials should be derived from the basis provided in the NEI 99-01, Rev. 4 guidance included in this enclosure.

UNUSUAL EVENT

1. Security threat or attempted entry or attempted sabotage. (NUREG-0654 UE

Example #12)

2. A credible. site-specific security threat notification. (2002 ICM Order)

3. A validated notification from NRC providing information of an aircraft threat (2005 Security Advisory)

Add a note to your existing EAL sets to ensure that NUREG-0654, UE Example EAL#

14 remains applicable for other hazards being experienced or projected.

ALERT

1. Ongoing security compromise (NUREG-0654 ALERT Example #16)

2. A validated notification from NRC of an airliner attack threat less than 30 minutes away.. (2005 Security Advisory).

3. A notification from the site security force of an armed attack, explosive attack, airliner impact, or other HOSTILE ACTION within the OCA.

Add a note to your existing EAL sets to ensure that NUREG-0654, Alert Example EAL#

18 remains applicable for other hazards being experienced or projected.

Page 10

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance SITE AREA

1. Imminent loss of physical control of the plant (NUREG-0654 Site Area Example

1. 14).

2. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSITLE ACTION is occurring or has occurred within the protected area.

Add a note to your existing EAL sets to ensure that NUREG-0654, Site Area Example EAL# 16 remains applicable for other hazards being experienced or projected with plant not in cold shutdown.

GENERAL EMERGENCY

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions.

Page 11

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance NUMARCINESP-007 (Revisedl Recognition Category H

Hazards and Other Conditions Affecting Plant Safety INITIATING CONDITION MATRIX

NOUE ALERT SITE AREA EMERGENCY GENERAL EMERGENCY

HUI Natural and Related Destructive HA1 Natural and Related Destructive Phenomena Affecting the Phenomena Affecting the Plant VITAL

PROTECTED AREA. AREA.

Op. Modes: All Op. Modes: All HU2 FIRE Within PROTECTED AREA HA2 FIRE or EXPLOSION Affecting the Boundary Not Extinguished Within 15 Operability of Plant Safety Systems Minutes of Detection. Required to Establish or Maintain Safe Op. Modes: All Shutdown.

Op. Modes: All HU3 Release of Toxic or Flammable Gases HA3 Release of Toxic or Flammable Gases Deemed Detrimental to Safe Operation Within a Facility Structure Which of the Plant. Jeopardizes Operation of Systems Op. Modes: All Required to Establish or Maintain Cold Shutdown.

Op. Modes: All HU4 Confirmed Security Event Which HA4 Security Event in a Plant PROTECTED HS.I Security Event in a Plant VITAL HG1 Security Event Resulting in Loss of Indicates a Potential Degradation in the AREA. AREA Physical Control of the Facility.

Level of Safety of the Plant. Op. Modes:.All Op. Modes: All Op, Modes: All Op. Modes: All HU5 Other Conditions Existing Which in the HA6 Other Conditions Existing Which in the HS3 Other Conditions Existing Which HG2 Other Conditions Existing Which in Judgment of the Emergency Director Judgment of the Emergency Director in the Judgment of the the Judgment of the Emergency Warrant Declaration of a NOUE. Warrant Declaration of an Alert. Emergency Director Warrant Director Warrant Declaration of Op. Modes: All Op. Modes: All Declaration of Site Area General Emergency.

Emergency. Op. Modes: All Op. Modes: All HA5 Control Room Evacuation Has Been HS2 Control Room Evacuation Has Initiated. Been Initiated and Plant Control Op. Modes: All Cannot Be Established.

Op. Modes: All HA7 Notification of an Airborne. Attack HS4 Site Attack Threat Op. Modes: All Op. Modes: All HA8 Notification of HOSTILE ACTION within the OCA

Op. Modes: All Page 12

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance NUMARC/NESP-007 Guidance Modify the ECL definitions as provided above.

Add the definition for HOSTILE ACTION and HOSTILE FORCE as provided above.

Delete existing EALS' as follows:

" HU4 EALU (Bomb device discovered within plant Protected Area and outside the plant Vital Area) because it is replaced by the new HOSTILE ACTION EAL HA8

" HA4 EAL1 (Intrusion into the PROTECTED AREA by a HOSTILE FORCE) because it is replaced by the new HOSTILE ACTION EAL HS4

" Any existing ISFSI Security EAL because it is replaced by either HOSTILE ACTION EAL

HA8 or Site Attack EAL HS4.

Delete existing HG1 and replace with NEI 99-01 HG1.

The following is a summary of the. Security IC/EALs for NESP-007 users. Verify that your EAL

sets include the following Security related EALs. Detailed bases for each IC/EAL follow this summary.

HU4 Confirmed Security Event Which Indicates a Potential Degradation in the Level of Safety of the Plant.

EXAMPLE EALs: (1 or 2 or 3)

1. Security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision (Existing NEI 99-01 HU4 EAL1).

2. A credible site-specific security threat notification (2002 ICM Order).

3. A validated notification from NRC providing information of an aircraft threat (2005 Security Advisory).

HA4 Security Event in a Plant PROTECTED AREA

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision. (Existing NEI 99-01 HA4 EAL2).

HA7 Notification of an Airborne Attack Threat

1. A validated notification from NRC of an airliner attack threat less than 30 minutes away (2005 Security Advisory).

HA8 Notification of HOSTILE ACTION within the OCA

1. A notification from the site security force that an armed attack, explosive attack, airliner impact or other HOSTILE ACTION is occurring or has occurred within the OCA.

Page 13

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HSI Security Event in a Plant Vital Area

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision (Existing NEI 99-01 HS1 EAL2).

HS4 Site Attack

1. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSTILE ACTION is occurring or has occurred within the protected area.

HG1 Security Event Resulting in Loss Of Physical Control of the Facility

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions (Existing NEI

99-01 HG1 EAL1).

Page 14

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

UNUSUAL EVENT

HU4 Confirmed Security Event Which Indicates a Potential Degradation in the Level of Safety of the Plant.

OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVELS: (1 or 2 or 3)

1. Security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision.

2. A credible site-specific security threat notification.

3. A validated notification from NRC providing information of an aircraft threat.

BASIS:

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Trainingon security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Safeguards Contingency Plan.

This EAL 1 is based on (site-specific) Site Security Plans. Security events which do not represent a potential degradation in the level of safety of the plant are reported under 10 CFR 73.7.1 or in some cases under 10 CFR 50.72. Examples of security events that indicate Potential Degradation in the Level of.Safety of the Plant are provided below for consideration.

Consideration should be given to the following types of events when evaluating an event against the criteria of the site specific Security Contingency Plan: CIVIL DISTURBANCE, and STRIKE

ACTION.

A higher initial classification could be made based upon the nature and timing of the threat and potential consequences. The licensee shall consider upgrading the emergency response status and emergency classification in accordance with the [site security specific] Safeguards

.Contingency Plan and Emergency Plans.

The intent of EAL 2 is to ensure that appropriate notifications for the security threat are made in a timely manner. This includes information of a credible threat. Only the plant to which the specific threat is made need declare the Notification of an Unusual Event.

The determination of "credible" is made through use of information found in the (site-specific)

Safeguards Contingency Plan or site procedures.

The intent of EAL 3 is to ensure that notifications for the security threat are made in a timely manner and that Offsite Response Organizations and plant personnel are at a state of heightened awareness regarding the credible threat. Only the plant to which the specific threat is made need declare the Notification of Unusual Event. This EAL is met when a plant receives information regarding an aircraft threat from NRC. Should the threat involve an airliner (airliner Page 15

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance is meant to be a large aircraft with the potential for causing significant damage to the plant) then escalation to Alert via HA7 would be appropriate if the airliner is less than 30 minutes away from the plant. The status and size of the plane may be provided by NORAD through the NRC. It is not the intent of this EAL-to replace existing non-hostile related EALs involving aircraft.

Page 16

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

ALERT

HA4 Other security events as determined from (site-specific) Safeguards Contingency Plan.

OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVEL:

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by.the (site-specific) security shift supervision.

BASIS:

This class of security events represents an escalated threat to plant safety above that contained in the Unusual Event.

Multi-unit stations with shared safety functions should further consider how this IC may affect more than one unit and how this may be a factor in escalating the emergency class.

.The Safeguards Contingency Plan identifies numerous events/conditions that constitute a threat/compromise to a Station's security. Only those events that involve Actual or Potential Substantial degradation to the level of safety of the plant need to be considered. The following events would not normally meet this requirement; (e.g., Failure by a Member of the Security Force to carry out an assigned/required duty, internal disturbances, loss/compromise of safeguards materials or strike actions).

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Security Plan.

Page 17

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

ALERT

HA7 Notification of an Airborne Attack Threat.

OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVEL:

1. A validated notification from NRC of an airliner attack threat less than 30 minutes away.

BASIS:

The intent of this EAL is to ensure that notifications for the security threat are made in a timely manner and that Offsite Response Organizations and plant personnel are at a state of heightened awareness regarding the credible threat. Only the plant to which the specific threat is made need declare the Alert. This EAL is met when a plant receives information regarding an airliner attack threat from NRC and the airliner is less than 30 minutes away from the plant.

This EAL is intended to address the contingency of a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from such an attack. Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite

• Response Organizations to be notified and encouraged to activate (if they do not normally) to be better prepared should it be necessary to consider further actions. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The. status and size of the plane may be provided by NORAD through the NRC.

Page 18

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

ALERT

HA8 Notification of HOSTILE ACTION within the OCA.

OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVEL:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact or other HOSTILE ACTION is occurring or has occurred within the OCA.

BASIS:

This EAL is intended to address the potential for a very rapid progression of events due to an attack including:

" air attack (airliner impacting the OCA)

" land-based attack (HOSTILE FORCE progressing across licensee property or directing projectiles at the site)

" waterborne attack (HOSTILE FORCE on water attempting forced entry, or directing projectiles at the site)

" BOMBs.

This EAL is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters or physical disputes between employees within the OCA or PA. That initiating condition is adequately addressed by other EALs.

This EAL is not premised solely on adverse health effects caused by a radiological release. Rather the issue is the immediate need for assistance due to the nature of the event and the potential for significant and indeterminate damage. Although NPP security officers are well trained and prepared to protect against HOSTILE ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin activation (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that initiating condition is adequately addressed by other EALs. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements.

Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an appropriate Federal agency would follow. In this case, appropriate federal agency is intended to Page 19

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance be NORAD, FBI, FAA or NRC. However, the declaration should not be unduly delayed awaiting Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be. provided by NORAD

through the NRC.

This IC/EAL addresses the immediacy of an expected threat arrival or impact on the site within a relatively short time. The fact that the site is an identified attack candidate with minimal time available for further preparation requires a heightened state of readiness and implementation of protective measures that can be effective (onsite evacuation, dispersal or sheltering) before arrival or impact.

Page 20

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

SITE AREA EMERGENCY

HSI Security Event in a Plant Vital Area OPERATING MODE APPLICABILITY: All.

EXAMPLE EMERGENCY ACTION LEVEL:

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision.

BASIS:

This class of security events represents an escalated threat to plant safety above that contained in the Alert IC.

The Safeguards Contingency Plan identifies numerous events/conditions that constitute a threat/compromise to a Station's security. Only those events that involve Actual or Likely Major failures of plant functions needed for protection of the public need to be considered. The following events would not normally. meet this requirement; (e.g.,. Failure by a Member of the Security Force to.carry out an assigned/required duty, internal disturbances, loss/compromise of safeguards materials or strike actions).

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Security Plan.

Loss of Plant Control would escalate this event to a GENERAL EMERGENCY.

Page 21

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

SITE AREA EMERGENCY

HS4 Site Attack OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVEL:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSITLE ACTION is occurring or has occurred within the protected area.

BASIS:

This class of.security events represents an escalated threat to plant safety above that contained in the Alert IC in that a hostile force has progressed from the Owner Controlled Area to the Protected Area.

Although NPP security officers are well trained and prepared to protect. against HOSTILE

ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin preparations for public protective actions (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address the potential.for a very rapid progression of events due to a dedicated attack. It is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters or physical disputes between employees within the OCAor PA. That initiating condition is adequately addressed by other EALs. HOSTILE ACTION

identified above encompasses various acts including:

• air attack (airliner impacting the protected area)

• land-based attack (hostile force penetrating protected area)

• waterborne attack (hostile force on water penetrating protected area)

". BOMBs breeching the protected area This EAL is intended to address the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that initiating condition is adequately addressed by other EALs. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements.

Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an appropriate Federal agency would follow. In this case, appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. However, the declaration should not be unduly delayed awaiting Page 22

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD

through the NRC.

This EAL addresses the immediacy of a threat to impact site vital areas within a relatively short time. The fact that the site is under serious attack with minimal time available for additional assistance to arrive requires ORO readiness and preparation for the implementation of protective measures.

Licensees should consider upgrading the classification to a General Emergency based on actual plant status after impact.

Page 23

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

GENERAL EMERGENCY

HGI Security Event Resulting in Loss Of Physical Control of the Facility OPERATING MODE APPLICABILITY: All EXAMPLE EMERGENCY ACTION LEVELS:

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions.

BASIS:

This IC encompasses conditions under which a HOSTILE FORCE has taken physical control of VITAL AREAs (containing vital equipment or controls of vital equipment) required to maintain safety functions and control of that equipment cannot be transferred to and operated from another location. Typically, these safety functions are reactivity control (ability to shut down the reactor and keep it shutdown) reactor water level (ability to cool the core), and decay heat removal (ability to maintain a heat sink) for a BWR. The equivalent functions for a PWR are reactivity control, RCS inventory, and secondary heat removal. If control of the plant equipment necessary to maintain safety functions can be transferred to another location, then the above initiating condition is not met.

This EAL should also address.loss of physical control of spent fuel pool cooling systems if imminent fuel damage is likely (e.g., freshly off-loaded reactor core in pool).

Loss of physical control of the control room or remote shutdown capability alone may not prevent the ability to maintain safety functions per se. Design of the remote shutdown capability and the location of the transfer switches should be taken into account.

Page 24

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance NEI 99-01 (Revised)

Recognition Category H

Hazards and Other Conditions Affecting Plant Safety INITIATING CONDITION MATRIX

NOUE ALERT SITE AREA EMERGENCY GENERAL EMERGENCY

HUI Natural and Related Destructive HAI Natural and Related Destructive Phenomena Affecting the Phenomena Affecting the Plant PROTECTED AREA. VITAL AREA.

Op. Modes: All Op. Modes: All HU2 FIRE Within PROTECTED AREA HA2 FIRE or EXPLOSION Affecting the Boundary Not Extinguished Within 15 Operability of Plant Safety Systems Minutes of Detection. Required to Establish or Maintain Op. Modes: All Safe Shutdown.

Op. Modes: All HU3 Release of Toxic or Flammable HA3 Release of Toxic or Flammable Gases Deemed Detrimental to Safe Gases Within or Contiguous to a Operation of the Plant. VITAL AREA Which Jeopardizes Op. Modes: All Operation of Safety Systems Required to Establish or Maintain Safe Shutdown.

Op. Modes: All HU4 Confirmed Security Event Which HA4 Confirmed Security Event in a Plant HS1 Confirmed Security Event in a HG1 Security Event Resulting in Loss Indicates a Potential Degradation in PROTECTED AREA. Plant VITAL AREA Of Physical Control of the Facility.

the Level of Safety of the Plant. Op. Modes: All Op. Modes: All Op. Modes: All Op. Modes: All HU5 Other Conditions Existing Which in HA6 Other Conditions Existing Which in HS3 Other Conditions Existing Which HG2 Other Conditions Existing Which in the Judgment of the Emergency the Judgment of the Emergency in the Judgment of the the Judgment of the Emergency Director Warrant Declaration of a Director Warrant Declaration of an Emergency Director Warrant Director Warrant Declaration of NOUE. Alert. Declaration of Site Area General Emergency.

Op. Modes: All Op. Modes: All Emergency. Op. Modes: All Op. Modes: All HA5 Control Room Evacuation Has Been HS2 Control Room Evacuation Has Initiated. Been Initiated and Plant Control Op. Modes: All Cannot Be Established.

Op. Modes: All HA7 Notification of an Airborne Attack HS4 Site Attack Threat Op. Modes: All Op. Modes: All HAS Notification of HOSTILE ACTION

within the OCA

Op. Modes: All Page 25

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance NEI 99-01 Guidance Modify the ECL definitions as provided above.

Add the definition for HOSTILE ACTION.

Delete existing EALS as follows:

" HA4 EAL1 (Intrusion into the PROTECTED AREA by a HOSTILE FORCE) because it is replaced by the new HOSTILE ACTION EAL HA8.

" HS1 EAL1 (INTRUSION into the plant VITAL AREA by a HOSTILE FORCE.) because it is replaced by the new HOSTILE ACTION EAL HS4.

0 E-HU2 (Confirmed security event with potential loss of level of safety of the ISFSl) because it is replaced by either HOSTILE ACTION EAL HA8 or Site Attack EAL HS4.

The following are the Security IC/EALs for NEI 99-01 users. Verify that your EAL sets include the following Security related EAL: Detailed bases for each IC/EAL follow this summary.

HU4 Confirmed Security Event Which Indicates a Potential Degradation in the Level of Safety of the Plant.

Example EAL: (1 or 2 or 3)

1. Security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision (Existing NEI 99-01 HU4 EAL1).

2. A credible site specific security threat notification (2002 ICM Order).

3. A validated notification from NRC providing information of an aircraft threat (2005 Security Advisory).

HA4 Confirmed Security Event in a Plant PROTECTED AREA

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision (Existing NEI 99-01 HA4 EAL2).

HA7 Notification of an Airborne Attack Threat

1. A validated notification from NRC of an airliner attack threat less than 30 minutes away (2005 Security Advisory).

HA8 Notification of HOSTILE ACTION within the OCA

1. A notification from the site security force that an armed attack, explosive attack, airliner impact or other HOSTILE ACTION is occurring or has occurred within the OCA.

Page 26.

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HS1 Confirmed Security Event in a Plant VITAL AREA

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision (Existing NEI 99-01 HS1 EAL2).

HS4 Site Attack

1. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSTILE ACTION is occurring or has occurred within the protected area.

HG1 Security Event Resulting in Loss Of Physical Control of the Facility

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions (Existing NEI

99-01 HG1 EAL1).

Page 27

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HU4 Initiating Condition - NOTIFICATION OF UNUSUAL EVENT

Confirmed Security Event Which Indicates a Potential Degradation in the Level of Safety of the Plant.

Operating Mode Applicability: All Example Emergency Action Levels: (1 or 2 or 3)

1. Security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision.

2. A credible site-specific security threat notification.

3. A validated notification from NRC providing information of an aircraft threat.

Basis:

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Safeguards Contingency Plan.

This EAL 1 is based on (site-specific) Site Security Plans. Security events which do not represent a potential degradation in the level of safety of the plant are reported under 10 CFR 73.71 or in some cases under 10 CFR 50.72. Examples of security events that indicate Potential Degradation in the Level of Safety of the Plant are provided below for consideration.

Consideration should be given to the following types of events when evaluating an event against the criteria of the site specific Security Contingency Plan: CIVIL DISTURBANCE, and STRIKE

ACTION.

The intent of EAL 2 is to ensure that appropriate notifications for the security threat are made in a timely manner. This includes information of a credible threat. Only the plant to which the specific threat is made need declare the Notification of an Unusual Event.

The intent of EAL 3 is to ensure that notifications for the security threat are made in a timely manner and that Offsite Response Organizations and plant personnel are at a state of heightened awareness regarding the credible threat. Only the plant to which the specific threat is made need declare the Notification of Unusual Event. This EAL is met when a plant receives information regarding an aircraft threat from NRC. Should the threat involve an airliner (airliner is meant to be a large aircraft with the potential for causing significant damage to the plant) then escalation to Alert via HA7 would be appropriate if the airliner is less than 30 minutes away from the plant. The status and size of the plane may be provided by NORAD through the NRC. It is not the intent of this EAL to replace existing non-hostile related EALs involving aircraft.

The determination of "credible" is made through use of information found in the (site-specific)

Safeguards Contingency Plan or site procedures.

Page 28

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance A higher initial classification could be made based upon the nature and timing of the threat and potential consequences. The licensee shall consider upgrading the emergency response status and emergency classification in accordance with the [site security specific] Safeguards Contingency Plan and Emergency Plans.

Page 29

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HA4 Initiating Condition - ALERT

Confirmed Security Event in a Plant PROTECTED AREA.

Operating Mode Applicability: All Example Emergency Action Level:

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision.

Basis:

This class of security events represents an escalated threat to plant safety above that contained in the NOUE.

Multi-unit stations with shared safety functions should further consider how this IC may affect more than one unit and how this may be a factor in escalating the emergency class.

The Safeguards Contingency Plan identifies numerous events/conditions that constitute a threat/compromise to a Station's security. Only those events that involve Actual or Potential Substantial degradation to the level of safety of the plant need to be considered. The following events would not normally meet this requirement; (e.g., Failure by a Member of the Security

. Force to carry out an assigned/required duty, internal disturbances, loss/compromise of safeguards materials or strike actions).

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Security Plan.

Page 30

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HA7 Initiating Condition - ALERT

Notification of an Airborne Attack Threat.

Operating Mode Applicability: All Example Emergency Action Level:

1. A validated notification from NRC of an airliner attack threat less than 30 minutes away.

Basis:

The intent of this EAL is to.ensure that notifications for the security threat are made in a timely manner and that Offsite Response Organizations and plant personnel are at a state of heightened awareness regarding the credible threat. Only the plant to which the specific threat is made need declare the Alert. This EAL is met when a plant receives information regarding an airliner attack threat from NRC and the airliner is less than 30 minutes away from the plant.

This EAL is intended to address the contingency of a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from such an attack. Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite Response Organizations to be notified and encouraged to activate (if they do not normally) to be better prepared should it be necessary to consider further actions. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD through the NRC.

Page 31

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HA8 Initiating Condition - ALERT

Notification or HOSTILE FORCE within the OCA

Operating Mode Applicability: All Example Emergency Action Level:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact or other HOSTILE ACTION is occurring or has occurred within the OCA.

Basis:

This EAL is intended to address the potential for a very rapid progression of events due to a hostile attack including:

• air attack (airliner impacting the OCA)

" land-based attack (hostile force progressing across licensee property or directing projectiles at the site)

" waterborne attack (hostile force on water attempting forced entry, or directing projectiles at the site)

" BOMBs This EAL is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters.or physical disputes between employees within the OCA or PA. That initiating condition is adequately addressed by other EALs.

This EAL is not premised solely on adverse health effects caused by a radiological release. Rather the issue is the immediate need for assistance due to the nature of the event and the potential for significant and indeterminate damage. Although NPP security officers are well trained and prepared to protect against HOSTILE ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin activation (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address, the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that initiating condition is adequately addressed by other EALs. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements.

Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an Page 32

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance appropriate Federal agency would follow. In this case, appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. However, the declaration should not be unduly delayed awaiting Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD

through the NRC.

This IC/EAL addresses the immediacy of an expected threat arrival or impact on the site within a relatively short time. The fact that the site is an identified attack candidate with minimal time available for further preparation requires a heightened state of readiness and implementation of protective measures that can be effective (onsite evacuation, dispersal or sheltering) before arrival or impact.

Page 33

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HSI

Initiating Condition - SITE AREA EMERGENCY

Confirmed Security Event in a Plant VITAL AREA

Operating Mode Applicability: All Example Emergency Action Level:

1. Other security events as determined from (site-specific) Safeguards Contingency Plan and reported by the (site-specific) security shift supervision.

Basis:

This class of security events represents an escalated threat to plant safety above that contained in the Alert IC.

The Safeguards Contingency Plan.identifies numerous events/conditions that constitute a threat/compromise to a Station's security. Only those events that involve Actual or Likely. Major failures of plant functions needed for protection of the public need to be considered. The following events would not normally meet this requirement; (e.g., Failure by a Member of the Security Force to carry out an assigned/required duty, internal disturbances, loss/compromise of safeguards materials or strike actions).

Reference is made to (site-specific) security shift supervision because these individuals are the designated personnel on-site qualified, and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Security Plan.

Loss of Plant Control would escalate this event to a GENERAL EMERGENCY.

Page 34

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HS4 Initiating Condition - SITE AREA EMERGENCY

Site Attack Operating Mode Applicability: All Example Emergency Action Level:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSITLE ACTION is occurring or has occurred within the PROTECTED

AREA.

Basis:

This class of security events represents an escalated threat to plant safety above that contained in the Alert IC in that a hostile force has progressed from the Owner Controlled Area to the Protected Area.

Although NPP security officers are well trained and prepared to protect against HOSTILE

ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin preparations for public protective actions (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address the potential for a very rapid. progression-of.events due to a dedicated attack. It is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters or physical disputes between employees within the OCA or PA. That initiating condition is adequately addressed by other EALs. HOSTILE ACTION

identified above. encompasses various acts including:

" air attack (airliner impacting the protected area)

" land-based attack (hostile force penetrating protected area)

" waterborne attack (hostile force on water penetrating protected area)

• BOMBs breeching the protected area This EAL is intended to address the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that.

initiating condition is adequately addressed by other EALs. This EAL is not premised solely on

• thepotential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements.

Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite. Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an appropriate Federal agency would follow. In this case, appropriate federal agency is intended to Page 35

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance be NORAD, FBI, FAA or NRC. However, the declaration should not be unduly delayed awaiting Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD

through the NRC.

This EAL addresses the immediacy of a threat to impact site vital areas within a relatively short time. The fact that the site is under serious attack with minimal time available for additional assistance to arrive requires (ORO readiness and preparation for the implementation of protective measures.

Licensees should consider upgrading the classification to a General Emergency based on actual plant status after impact.

Page 36

Attachment 3 Enhanced Emergency Action Levels Implementation Guidance HAZARDS AND OTHER CONDITIONS

AFFECTING PLANT SAFETY

HG1 Initiating Condition - GENERAL EMERGENCY

Security Event Resulting in Loss of Physical Control of the Facility..

Operating Mode Applicability: All Example Emergency Action Level:

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions.

Basis:

This IC encompasses conditions under which a HOSTILE FORCE has taken physical control of VITAL AREAs (containing vital equipment or controls of vital equipment) required to maintain safety functions and control of that equipment cannot be transferred to and operated from another location. Typically, these safety functions are reactivity control (ability to shut down the reactor and keep it shutdown) reactor water level (ability to cool the core), and decay heat removal (ability to maintain a heat sink) for a BWR. The equivalent functions for a PWR are reactivity control, RCS inventory, and secondary heat removal. If control of the plant equipment necessary to maintain safety functions can be transferred to another location, then the above initiating condition is not met.

This EAL should also address loss of physical control of spent fuel pool cooling systems if imminent fuel damage is likely (e.g., freshly off-loaded reactor core in pool).

Loss of physical control of the control room or remote shutdown capability alone may not prevent the ability to maintain safety functions per se. Design of the remote shutdown capability and the location of the transfer switches should be taken into account.

Page 37

Attachment 4 Example Tools for the Development of Onsite Protective Actions Example 1

1. Determine the evacuation times for the following scenarios.

Normal site population* Night/Holiday site Outage site population population Good Bad Good Bad Good Bad weather weather weather. weather weather weather PA

Evacuation OCA

Evacuation

2. Using the above data, enter whatever "Actions" can be completed within the warning timeframe:

Imminent Threat Informational > 30 min warning

(< 5 min warning) (5-30 min warning)

ERO Actions

(1)

Ops/Fire Brigade Actions (2)

Other population Actions (3)

(1) Possible actions:

• staff ERF's

• take cover

• staff alternate/offsite facility

• take no action.

(2) Possible actions:

• staff CR

• take cover

• disperse to onsite facility

• staff alternate/offsite facility

• take no action.

(3) Possible actions:

" take cover

• move to assembly area outside PA,

• move to assembly area off/near site

• take no action.

(continued)

Page 38

Attachment 4 Example Tools for the Development of Onsite Protective Actions Discussion of Possible Actions:

Staff ERF's Considerations include of this action includes: location and robustness of onsite ERF's and proximity of ERF's to likely targets.

Take cover An action intended to allow use of immediately available structures to provide personal protection.

Staff alternate/Offsite facility With respect to the ERO or other essential personnel, this action could result in the survivability of emergency personnel, and places them in a facility which allows them to begin assessment and mitigating actions with minimal delay..

Take no action Assumes no action is needed to protect personnel.

Staff CR

Assumes personnel outside the CR can travel and work there safely.

Disperse to onsite facility Pertains to personnel who would be needed onsite for plant assessment or mitigative actions. The onsite facility would be presumed to by outside the range of damage to likely targets.

Move to assembly area outside PA

May be used to protect non-essential site personnel in sites that have an assembly area outside the outside the range of damage to likely targets.

Move to assembly area off/near site May be used to protect non-essential site personnel in sites that have off or near site assembly areas. This area may be the same as the alternate/offsite facility described above.

Page 39

Attachment 4 Example. Tools for the Development of Onsite Protective Actions Example 2

1. Determine (circle) the evacuation times for the following scenarios:

NOTE: Opening the protected area vehicle gates or freewheeling the turnstiles will reduce the evacuation times.

Normal site population Night/Holiday site Outage site population

_population Good Bad Good Bad Good Bad weather weather weather weather weather weather PA

Evacuation OCA

Evacuation

2. Determine where to send Emergency Response Organization and Non-Essential Personnel based on time and type of threat:

Possible Actions:

• Take no action * Report to area outside PA

• Take cover 0 Report to offsite stagingarea.

• Report to onsite Assembly Areas 0 Report to alternate/offsite ERF

• Reoort to ERF's * Renort

• Ivr,. .....

to recention center.

.... r ............

Airborne Informational Urgent Immediate Desired Actions: > 30 min warning (5-30 min warning) (<5 min warning)

Licensed...."... TBD TBD TBD

Operators ERO Go to the Off-Site Go to the ERF's Take Cover Staging Area Non-Essential SaigAe ______________________

Ponnel Exit OCA Exit Protected Area Personnel Take Cover Script #1 Script #2 Script #3 Land/Water Informational Urgent Immediate Desired Actions: > 30 min warning (5-30 min warning) <5 min warning)

Licensed TBD

Operators TBD

ERO Go to the ERF's Go to the ERF's Take Cover Non-Essential Go to the Assembly Take Cover Take Cover Personnel Areas Script #4 Script #5 Script #3 Bomb/Other Informational Urgent Immediate Desired Actions: > 30 min warning (5-30 min warning) <5 min warning)

Licensed TBD ,-D

Operators TB.........

ERO Go to the ERF's Go to the ERF's Take Cover Non-Essential Exit Protected Area Exit Protected Area Take Cover Personnel I I

Script #2 I Scriot #2 Scriot #3 Page 40

Attachment 4 Example Tools for the Development of Onsite Protective Actions

3. Announce the appropriate script below (or as deemed necessary) over the plant PA

system:

SCRIPT #1: "Attention in the, plant,.attention in the plant. A credible threat has been determined to exist at the station. All ERO members report to the offsite staging area. All non-essential personnel exit the owner controlled area and proceed home. I repeat, A credible threat has been determined to exist at the station. All ERO members report to the offsite staging area. All non-essential personnel exit the owner controlled area and proceed home."

SCRIPT #2: "Attention inthe plant, attention in the plant. A credible threat has been determined to exist at the station. All ERO members report to your emergency response facility. All non-essential personnel exit the protected area and take coverin the XXXX buildings. I repeat, A credible threat has been determined to exist at the station. All ERO members report to your emergency response facility. All non- essential personnel exit the protected area and take cover in the

-XXX)

buildings."

SCRIPT #3: 'Attention in the plant, attention in the plant. A credible threat has been determined to exist at the station. All personnel take immediate cover inside the nearest building. I repeat, All personnel take immediate cover inside the nearest building."

SCRIPT #4: "Attention in the plant, attention in the plant. A credible threat has been determined to exist at the station. All ERO members report to your emergency response facility. All non-essential personnel report to your designated assembly area. I repeat, A credible threat has been determined to exist at the station. All ERO members report to your emergency response facility. All non-essential personnel report to your designated assembly area."

SCRIPT #5: "Attention in the plant, attention in the plant. A credible threat has been determined to exist at the station. All ERO members report to your emergency response facility. All non-essential personnel take immediate cover inside the nearest building. I repeat, A credible threat has been determined to exist at the station. All ERO

members report to your emergency response facility. All non- essential personnel take immediate cover inside the nearest building."

Page 41

Attachment 5 Integrated Response Exercise Integration and Demonstration of Emergency Response to Security Events Integrated Response Exercise Program Summary The NEI Emergency Preparedness and Security Working Group worked with the NRC staff to establish guidelines for integration and demonstration of emergency responses to security events, including preparation and conduct of integrated drills exercising. Emergency Response Organizations', Operation's, and Security's response to a range of security events. The NEI task force's target date for developing draft guidelines was the 1st quarter, 2005, followed by 4 industry tabletop drills and 2 pilot drill demonstrations within 9-12 months.

Lessons learned from these drills will be used to improve guidelines for industry use, and for internal site reviews, training, and future drills. Over the following 3 years it is expected that each site will initiate an integrated drill .during the off year. The long-term expectations are that each site will demonstrate an emergency response to security event one time during the 6-year biennial exercise cycle.

Phase I

• Formulate NEI EP Security Task Force

- Develop industry guidelines

- Develop scenario abstracts

- Identify industry peer review team

- Develop Tabletop protocol

• Coordinate a pilot program (2005-2006) Tabletops

" Validate guidelines

• Consider FEMA evaluation criteria

• Develop lessons learned Phase II

• Conduct 2 Pilot Integrated Drills using Industry Guidance

• Obtain NRC Endorsement of Industry Guidance

• Conduct joint NRC/NEI Workshop Phase III

• Complete drills at all sites within 3 years of completion of pilot Phase IV

• Once sites have completed initial integrated drills; incorporate into 6 year biennial exercise plan Page 42

Attachment 5 Integrated Response Exercise Conduct Of Activities Table tops

" Involve stake holders such as licensees, State & local emergency management / law enforcement, medical & fire response. Drills

" Drills - Agreement of. 2 onsite drills with limited participation.

• Offsite roles / response can be provided by control cell based on knowledge gained in tabletops.

• Drills to be conducted in the off year for the pilot.

" Pilot plants should have selection consideration based in part on "risk- informed" criteria.

• A series of scenarios should be developed to exercise various aspects of

• threats as the threat may require different consequence management -actions.

Full Implementation - After Pilot

• All plants conduct hostile action-based scenarios over 3 (or more) years.

• Following the NRC observed plant demonstration; the licensee will include hostile action-based scenarios in the Drill and exercise program for exercise

• selection on a six-year frequency.

• Full implementation needs to include engagement of Offsite responders and FEMA.

Scenarios - EP Response Focus The scenario should address EP response actions early in the event that includes such aspects as initial classification, notification, PARs if appropriate, and protective measures onsite. Use '.time-jump" or other techniques to pass through the security event, and then pick up EP response actions based on a postulated damage state of the site / facility.

• Various scenarios should be developed to address response to different threat modes, various initiators or response capabilities such as onsite facilities available / not available or alternative accountability processes.

• The differences in response actions (delta's) need to be thought through for security events vs non-security events.

Page 43

Attachment 5 Integrated Response. Exercise Project Timeline Phase 1 - Develop Materials and Conduct Pilot Tabletops

• Initial draft of guidance docum ents ..................................................... 02/16/05 [Done]

• EP Security Event Drill task force meeting ...................... ...... 03/15/05 [Done]

• NEI task force pre-m eeting . ................. ............................. 03/30/05 [Done]

• Presentation to NRC/FEMA (supplant EP demonstration in FOF) . 03/31/05 [Done]

• National FEMA REP Presentation ..................................................... 04/13/05 [Done]

• National Nuclear Security Conference ...... ............. ...................... 06/06/05 [Done]

• NEI EP Forum Presentation ............................................................... 06/14/05 [Done]

• Conduct 4 site tabletops (one in each region) ............................. June '05 - March '06 Phase 2 - Test Baseline Drills

• Revise guideline based on Phase 1 results ..................... January '06

• Conduct 2 site drills ..................................... March - May'06 Phase 3 - Conduct Baseline Drills (industry wide)

" Finalize guideline based on Phase 2 results ................................................... May '06

" NRC endorsement .......................... , .................. May'06

• Joint Industry/N RC W orkshop ...................................................................... June '06

• Utilities conduct baseline Security Event Drills ...................... July '06 - December '08 Phase 4 - Implement Security Event as Evaluated Exercises Page 44