RIS 2015-08, Oversight of Counterfeit, Fraudulent, and Suspect Items in the Nuclear Industry
| ML15008A191 | |
| Person / Time | |
|---|---|
| Issue date: | 06/24/2015 |
| From: | Michael Cheok, James Gaslevic, Kokajko L, Piccone J, Westreich B Office of Nuclear Material Safety and Safeguards, NRC/NRO/DCIP/CITB, Division of Policy and Rulemaking, Office of Nuclear Security and Incident Response |
| To: | |
| Gaslevic J, NRO/DCIP/IGCB, 415-2776 | |
| References | |
| RIS-15-008 | |
| Download: ML15008A191 (14) | |
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS
OFFICE OF NUCLEAR REACTOR REGULATION
OFFICE OF NEW REACTORS
WASHINGTON, DC 20555 June 24, 2015 NRC REGULATORY ISSUE SUMMARY 2015-08 OVERSIGHT OF COUNTERFEIT, FRAUDULENT, AND SUSPECT ITEMS IN THE
NUCLEAR INDUSTRY
ADDRESSEES
All U.S. Nuclear Regulatory Commission (NRC) licensees and certificate holders, Agreement State Radiation Control Program Directors, and State Liaison Officers.
All contractors and vendors that supply basic components to NRC licensees. All vendors and suppliers of safety-related components and digital assets associated with Section 73.54, Protection of digital computer and communication systems and networks, of Title 10, Energy, of the Code of Federal Regulations (10 CFR).
INTENT
The NRC is issuing this regulatory issue summary (RIS) to heighten awareness of the existing NRC regulations and how they apply to counterfeit, fraudulent, and suspect items (CFSI) within the scope of NRCs regulatory jurisdiction.
Addressees
are expected to review this information and consider actions, as appropriate, to prevent CFSI from entering their supply chains, prevent possible installation or use of CFSI at their facilities, and raise awareness of the potential for CFSI to be used in the manufacture, maintenance, or repair of items, including sealed sources and devices (SSDs). The NRC is providing this RIS to the Agreement States for their information and for distribution to their licensees, as appropriate. Additionally, addressees may consider sharing this RIS with their contractors and suppliers, as appropriate. This RIS requires no specific action or written response on the part of an addressee. This RIS does not transmit nor imply any new or changed requirements or staff positions.
BACKGROUND
The NRCs regulations are designed to protect both the public and workers from radiation hazards resulting from regulated activities. Regulated entities are responsible for the safety and security of radioactive materials, subject to the NRCs oversight programs. NRC oversight programs are designed to ensure compliance with the agencys requirements, in part, through inspection, enforcement and, when warranted, investigations. Any organization or individual who provides counterfeit or fraudulent material to an NRC-regulated entity in violation of the NRCs requirements may be subject to inspection, investigation, enforcement, and possible criminal prosecution.
Addressees
actions following discovery of an issue that is likely of a ML15008A191 counterfeit or fraudulent nature, may impact the ability of the NRC staff to perform inspection and/or investigation activities. Additionally, licensees, or applicants, that have identified a counterfeit or fraud-related condition must ensure continued compliance with NRC regulations regarding completeness and accuracy of information.
Over the past three decades, the NRC has issued multiple generic communications to inform stakeholders of counterfeit or misrepresented products and services.
In March 1989, the NRC staff issued Generic Letter (GL) 89-02, Actions To Improve the Detection of Counterfeit and Fraudulently Marketed Products (Agencywide Documents Access and Management System (ADAMS) Accession No. ML031140060). GL 89-02 informed licensees of effective program elements for detecting counterfeit or fraudulently marketed products and for assuring the quality of vendor-supplied products. The GL also identified Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities;
Regulatory Guide (RG) 1.28, Quality Assurance Program Criteria (Design and Construction)
(ADAMS Accession No. ML100160003); and RG 1.33, Quality Assurance Program Requirements (Operation) (ADAMS Accession No. ML13109A458), as containing appropriate discussions on procurement quality-assurance controls. The GL described three characteristics of effective procurement and dedication programs that reduce the likelihood of the introduction of counterfeit or fraudulent products into their plants:
1. the involvement of engineering staff in the procurement and product acceptance process;
2. effective source inspection, receipt inspection, and testing programs;
3. thorough engineering-based programs for review, testing, and dedication of commercial-grade products for suitability for use in safety-related applications.
In April 1991, the NRC staff issued GL 91-05, Licensee Commercial-Grade Procurement and Dedication Programs (ADAMS Accession No. ML031140508) to communicate staff positions regarding certain aspects of licensee commercial-grade procurement and dedication programs which would provide acceptable methods for meeting regulatory requirements.
The NRC staff has previously considered introducing regulatory language to specifically address counterfeit and fraudulent items, but withdrew the advance notice of proposed rulemaking, citing that the staff believes that problems identified with respect to the quality of items dedicated for use in safety-related applications are adequately addressed by the requirements of Appendix B
to 10 CFR Part 50 and, for the most part, are problems of compliance, rather than of inadequate rules1.
Since 2008, the staff has issued four Information Notices (IN) related to CFSI. IN 2008-04, Counterfeit Parts Supplied to Nuclear Power Plants (ADAMS Accession No. ML093620098)
1 SECY-94-277, Withdrawal of Advance Notice of Proposed Rulemaking Acceptance of Products Purchased for Use in Nuclear Power Plant Structures, Systems and Components (ADAMS Accession No. ML14268A013) was issued to inform addressees of the potential for counterfeit parts to enter their supply chains. IN 2012-22, Counterfeit, Fraudulent, Suspect Items (CFSI) Training Offerings, (ADAMS Accession No. ML12137A248) provides a list of training resources that can be used for educating personnel involved in NRC-regulated activities on current trends in CFSI and techniques to prevent the use of CFSI parts. The staff issued IN 2013-02, Issues Potentially Affecting Nuclear Facility Fire Safety, (ADAMS Accession No. ML122840031) to draw attention to reports of counterfeit fire protection equipment that had been issued by the U.S. Defense Logistics Agency Headquarters and Underwriters Laboratories, Inc. IN 2013-15, Willful Misconduct/Record Falsification and Nuclear Safety Culture, (ADAMS Accession No.
ML13142A437) describes a vendors criminal actions to destroy serial numbers in an attempt to conceal a components origin before it was installed in a U.S. nuclear plant.
In the past, the NRCs generic communications regarding CFSI focused on nuclear power plants. However, awareness and vigilance of CFSI has increased and expanded to affect all NRC-regulated activities and other nuclear industry stakeholders. These include fuel cycle facilities; basic component manufacturers and suppliers; supply-chain distributors, users, entities that are specifically licensed to provide maintenance, repair, and other services for devices or sources containing byproduct materials, and manufacturers of SSDs; medical, industrial, and academic applications of nuclear materials; entities involved in the transportation, storage, and disposal of nuclear materials and waste; and the decommissioning of nuclear facilities.
It is also important to note that the NRCs Safety Culture Policy Statement (SCPS) is applicable to all NRC licensees and certificate holders, as well as vendors and suppliers, and others involved in NRC-regulated activities. A positive safety culture includes attributes such as maintaining an environment for raising concerns, adopting a questioning attitude, practicing effective problem identification and resolution, engaging in effective safety communications, and supporting continuous learning. A positive safety culture may also promote a vigilant workforce with respect to identifying and dispositioning CFSI. Additional information about the NRCs SCPS, including copies of the SCPS Brochure (NUREG/BR-0500, Revision 3) can be found on the NRCs Safety Culture Webpage, http://www.nrc.gov/about-nrc/safety-culture.html.
Regarding CFSI, all workers in the nuclear industry or members of the general public have the option of reporting nuclear safety concerns directly to the NRC through the NRCs Allegation Program by contacting any NRC employee, including a resident inspector, or calling the NRC's toll free safety hotline at 1-800-695-7403 (see NUREG/BR 0240 Rev 6, Reporting Safety Concerns to the NRC (ADAMS Accession No. ML12146A003) and the NRCs Allegations Web page).
SUMMARY OF ISSUE
The increasing prevalence of CFSI in other industries may present challenges to the nuclear industrys supply chain. Although supply chains for other industrial sectors may be substantially affected by CFSI events, it is the NRCs position that adherence to existing NRC regulations provides adequate protection of the public health and safety. As new occurrences and methods of counterfeit and fraudulent activity increase in other industrial sectors, it is in the interest of the nuclear industry to evaluate its approach in this area. This RIS provides a description of the NRCs regulatory framework relevant to CFSI. This RIS is divided into discussions of CFSI as it applies to three general areas of the nuclear industry: nuclear reactors, nuclear materials, and radioactive waste. Each section includes a description and a discussion of NRC regulations that directly apply to CFSI.
NUCLEAR REACTORS
Nuclear reactors include power reactors and non-power research and test reactors (RTRs).
The NRC relies on quality assurance programs to provide confidence that applicable structures, systems and components (SSC) will perform their specified safety function(s) as described in the licensees Updated Final Safety Analysis Reports (UFSAR). Each power reactor licensee has and maintains an NRC-approved quality assurance program. Reductions in commitments within these programs cannot be made without prior NRC staff approval. RTRs generally have quality program requirements stated in their technical specifications. Regulations, licenses, regulatory guidance (e.g., regulatory guides and generic communications) and industry standards describe requirements, and acceptable approaches to establish and maintain quality assurance programs. In addition, regulations and licenses require licensees to formally report a broad range of conditions that challenged or could have challenged the ability of equipment to perform specified safety functions.
CFSI can result in noncompliance with regulatory requirements. While potentially malicious code embedded in the software of digital electronic components does not constitute a new failure mode for these devices, this form of tampering (embedded software coding) is unique to digital electronic devices where it can prevent the device from performing its intended safety- function, or cause other safety-related components to fail to perform their intended safety function(s). However, neither industry nor the NRC has identified a new or unique failure mode associated with a counterfeit or fraudulent item that could not be reasonably identified or eliminated by an effective NRC-approved quality assurance (QA) program. Thus, adherence to effective QA programs should be effective in addressing CFSI for digital hardware. When embedded code is inserted in hardware, additional risks to safety and security may arise.
Regulatory Guide 5.71, Appendix C , Operational and Management Security Controls, specifically section C.3.3, Malicious Code Protection, section C.3.7, Software and Information Integrity, and section C.12, System and Service Acquisition, address malicious code controls and provide guidance for acceptable methods for meeting the requirements of 10 CFR 73.54.
Thus, cybersecurity programs can also be effective in addressing CFSI for embedded code inserted in hardware.
Power Reactors The NRC provides oversight of power reactor licensee activities through a Reactor Oversight Process that includes performance indicators, inspections, and assessment of licensee performance. Inspection activities provide a risk-informed, performance-based approach toward monitoring overall plant performanceof which quality assurance is a key aspect. Enforcement measures are used to address noncompliance with regulatory requirements, when necessary.
Nuclear power plants contain SSCs which function to prevent and/or mitigate the consequences of postulated accidents; these SSCs are referred to as safety related. Although not described as safety-related, other SSCs may have functions that are important-to-safety. NRC-approved quality assurance programs describe the specific application of 10 CFR Part 50, Appendix B,
Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, or simply Appendix B, to safety-related SSCs. All Appendix B criteria are applied to safety-related SSCs. For equipment that is important to safety, licensees may apply a subset of Appendix B
criteria. It is important to note that while Appendix B sets forth the general requirements of quality assurance programs, licensee commitments concerning quality assurance are maintained in each licensees licensing basis documentation which includes the NRC-approved quality assurance program that is controlled pursuant to 10 CFR 50.54.
Appendix B serves as the foundation for NRC requirements in the area of quality assurance for nuclear reactor licensees. The 18 criteria of Appendix B provide standards that are intended to ensure adequate confidence that safety-related SSCs will perform their specified functions as described in the UFSAR. The 18 criteria of Appendix B provide regulatory requirements in six broad areas directly applicable to the area of CFSI: 1) design control; 2) procurement document control; 3) control of purchased material, equipment, and services; 4) identification and control of material, parts, and components; 5) disposition of nonconforming materials, parts, or components; and 6) corrective action and program effectiveness reviews.
NRC licensees and applicants may not be in a position to immediately determine if a suspect item is counterfeit or fraudulent; it is more likely that either a deviation from a procurement specification or a component failure is all that will be evident. Criterion XVI, Corrective Action, states that licensees must take corrective actions for conditions adverse to quality, and to perform root cause evaluations for significant conditions adverse to quality. Licensees are responsible for classifying conditions adverse to quality in terms of their significance.
Throughout that process licensees may consider that, while certain suspect components may not in and of themselves present a significant impact on plant safety, the fact that a vendor has provided suspect components to a nuclear plant may warrant an extent of condition review to ensure that components with a higher safety significance are not similarly affected.
The NRC requires that power reactor licensees and applicants periodically evaluate their quality assurance programs through audits and program reviews to ensure adequacy and effectiveness. Criterion II Quality Assurance Program states that regular reviews of the status and adequacy of quality assurance programs shall be performed, and Criterion XVIII Audits states that periodic audits of quality assurance programs shall be carried out. Industry guidance, to which some licensees have committed within their quality assurance programs, suggests that recent industry experience should be used to inform the processes for conducting both internal and external audits. As more industry experience concerning a specific condition adverse to quality becomes available (e.g., CFSI), it is in the industrys interest to incorporate the insights from that experience within their program reviews.
Several Appendix B criteria ensure that quality is maintained during material procurement processes. For example, Criterion IV, states in part that requirements which are necessary to assure adequate quality are suitably included or referenced in the documents for procurement of material... Implementing guidance for this criterion provides several considerations that purchasers should explore when developing procurement documents:
1) the component or materials impact to nuclear safety; 2) the components complexity of design and ability to be adequately tested/inspected; and 3) the components quality history. Additionally, GL 89-02, Actions to Improve the Detection of Counterfeit and Fraudulently Marked Products, describes three characteristics of effective procurement programs, one of which is involvement of engineering staff in the procurement process. For example, engineering staff can help establish the importance of the procured item to nuclear safety and an effective acceptance process.
Criteria VII, VIII, X, and XIV (Control of Purchased Material, Equipment, and Services;
Identification and Control of Materials, Parts and Components; Inspection; and Inspection, Test and Operating Status, respectively) all deal with the procurement process. The general process consists of licensees and applicants establishing measures to ensure that material is appropriately purchased from suppliers that are selected on the basis of objective evidence of the quality of the product or service they provide; that those products and services conform to the applicable procurement specification; and that the material is properly inspected on receipt, and marked so that the level of inspection is evident to potential users. NRC RG 1.33, Quality Assurance Program Requirements (Operation), (ADAMS Accession No. ML13109A458)
endorses American National Standards Institute (ANSI) and American Nuclear Society (ANS)
standard ANSI/ANS 3.2-2012, Managerial, administrative, and quality assurance controls for the operational phase of nuclear power plants, which provides guidance for control of purchased material that is applicable to the CFSI issue. ANSI/ANS 3.2-2012 states, A procedure (or procedures) shall be implemented to aid in the identification of counterfeit and fraudulently marketed products. As a minimum, a procedure (or procedures) should include selective inspections and testing of products to verify compliance with procurement requirements when products are suspect. It should be noted that endorsement of ANSI/ANS
3.2-2012 by RG 1.33 is guidance and not a requirement to adopt ANSI/ANS 3.2-2012.
Criterion XV, Nonconforming Materials, Parts, or Components, requires that nonconforming items be controlled to prevent their inadvertent use or installation. These controls should include marking, segregation, dispositioning of the item, and notification of affected organizations. Criterion XV serves many purposes in terms of CFSI. These include marking and separation of suspect material from quality material to ensure that the suspect material is not used, and documentation and notification measures that could be useful in the case of a formal investigation. ASME NQA-1-2008 and ASME NQA-1a-2009 Addenda, Quality Assurance Requirements for Nuclear Facility Applicationsapproved for use in RG 1.28, Quality Assurance Program Criteria (Design and Construction) in July 2009provides additional acceptable approaches for this area. Notification of affected organizations may feed recent experience into corrective action programs, which could be used to improve the procurement process or inform quality assurance program reviews and audits.
The NRC provides several mechanisms for licensees to provide information to the agency, and since reports to the agency are generally publicly available, this information is available for dissemination to industry and other stakeholders Regulations governing reporting, notably
10 CFR 50.72, Immediate notification requirements for operating nuclear power reactors;
10 CFR 50.73, Licensee event report system; and 10 CFR Part 21 establish criteria for reporting events or significant issues to the NRC within a specified amount of time. These reports are typically focused on events or conditions that have a certain level of safety significance regardless of the specific causal factors. In general, it is the effect of the condition on the safety of the plant that drives the determination of reportability and corrective action warranted by licensees. Causal factors for an event or condition could include CFSI. In most cases, a CFSI event would not be reportable to the NRC on its own merits; the exceptions being events that satisfy the requirements of Part 21 and 10 CFR 50.9.
Regulations in 10 CFR Part 21 establish requirements for the reporting of defects and noncompliances. As it pertains to Part 21, counterfeit and fraudulent items are departures from technical requirements in applicable procurement documents; therefore, they are deviations that must be evaluated to determine if they create a substantial safety hazard2. Items that are suspected of being counterfeit and fraudulent represent deviations only if the suspected condition results in a departure from a technical requirement that is sufficiently specified in the procurement document. If a suspected counterfeit and/or fraudulent condition is determined to represent a deviation, then the condition must be evaluated to determine if it creates a substantial safety hazard. If it is determined that a deviation results in a substantial safety hazard, then the condition must be reported to the NRC.
Regulations in 10 CFR 50.9(b) require that a licensee notify the NRC of information that the licensee has identified as having a significant implication for public health and safety or common defense and security. It is useful to note that, for a violation of 50.9 to occur the licensee must recognize the significance of the information and fail to report it to the NRC. Federal Register Volume 52, No. 47, March 11, 1987 (page 7436), states that What is expected is a professional attitude toward safety throughout a licensees or applicants organization such that if a person identifies some potential safety information, the information will be freely provided to the appropriate company officials to determine its safety significance and reportability to the Commission.
To date, most CFSI-related events have not risen to the safety thresholds established by
10 CFR Part 21 and 10 CFR 50.9. Nonetheless, licensees, applicants and vendors may submit voluntary reports to communicate significant deviations from procurement specifications with potentially generic implications since in most cases safety significance must be determined on a plant specific basis. Section 2.7, Voluntary Reporting, of Revision 3 of NUREG 1022, Event Report Guidelines 10 CFR 50.72 and 50.73 (ADAMS Accession No. ML13032A220) contains guidance on how to make voluntary reports. This guidance encourages the use of the licensee event report because this format provides the information needed to support NRC review of the event and facilitates administrative processing, including data entry.
Regulations in 10 CFR 73.54, Protection of digital computer and communication systems and networks, apply to CFSI because each licensee is required to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks. RG 5.71, Cyber Security Programs for Nuclear Facilities, (ADAMS Accession No. ML090340159) discusses an acceptable approach for supply chain protection measures to maintain integrity of the digital assets that are acquired by licensees. Criteria listed in the RG
are directly applicable to prevention or detection of CFSI that could be introduced into the cybersecurity supply chain.
2
10 CFR 21.3, Definitions, Substantial safety hazard means a loss of safety function to the extent that there is a major reduction in the degree of protection provided to public health and safety for any facility or activity licensed or otherwise approved or regulated by the NRC, other than for export, under parts 30, 40, 50, 52, 60, 61, 63, 70, 71, or
72 of this chapter. Non-Power Research and Test Reactors (RTRs)
The NRC provides guidance to RTRs in Regulatory Guide (RG) 2.5, Quality Assurance Program Requirements for Research and Test Reactors, Revision 1, June 2011 (ADAMS
Accession No. ML093520099). RG 2.5 endorses ANSI/ANS-15.8-1995 (reaffirmed in September 2005), Quality Assurance Program Requirements for Research Reactors. Although the guidance in ANSI/ANS-15.8-1995 is not as detailed as the guidance found in this RIS for power reactors, RTRs may still find the information in this RIS useful for the handling of CFSI.
NUCLEAR MATERIALS
Nuclear materials include uses of nuclear materials in medical, industrial, and academic settings and facilities that produce nuclear fuel.
Regulations in 10 CFR 21.21, Notification of failure to comply or existence of a defect and its evaluation, contain the requirements for evaluating and reporting deviations and failures to comply associated with substantial safety hazards. Counterfeit and fraudulent items installed as basic components in nuclear facilities or used as basic components in activities regulated by the NRC could create a substantial safety hazard by not performing their intended safety function when needed. In accordance with 10 CFR Part 21, reporting a defective basic component (i.e., the counterfeit or fraudulent part) would be required by the licensee if an evaluation determines that the deviation could create a substantial safety hazard.
Sealed Sources and Devices Regulations in 10 CFR Part 32, Specific Domestic Licenses To Manufacturer Or Transfer Certain Items Containing Byproduct Material, contain requirements for manufacturers or initial distributors of sealed sources or devices containing sealed sources. The NRC reviews the design and construction of SSDs containing byproduct material to make a determination that the product meets quality and safety standards required by 10 CFR 32.210, Registration of product information, for acceptability for licensing purposes. The registration, as conducted by the NRC, consists of issuance of a registration certificate that (a) confirms that the SSD design meets the regulatory requirements of 10 CFR 32.210 and (b) lists the provisions of use for the product. As stated in NRC SSD registration certificates, holders of those certificates must adhere to the commitments made in their applications for SSDs. As part of a request for the registration of a sealed source or a device, an applicant for a registration certificate must include sufficient information about its quality control program to provide reasonable assurance that the radiation safety properties for the source or device will be maintained as designed and registered to protect health and minimize danger to life and property during the manufacturing process. Certificate holders should remain vigilant and maintain effective quality assurance programs to reduce the potential for introduction of fraudulently misrepresented parts into their supply chains.
As a reminder to users of SSDs licensed under 10 CFR 30.32, Application for specific licenses, only those entities that are specifically licensed by the NRC or an Agreement State by license condition may provide maintenance, repair, and other services for devices or sources containing byproduct material. No changes can be made to devices or sources containing byproduct material that would affect the commitments made in the SSD registration without the prior approval of the proper regulatory authority.
Fuel Cycle Facilities Fuel cycle facilities (FCFs) include conversion and deconversion facilities subject to 10 CFR Part 40, Domestic Licensing of Source Material, and enrichment and fuel-fabrication facilities subject to 10 CFR Part 70, Domestic Licensing of Special Nuclear Materials, and 10 CFR Part 76, Certification of Gaseous Diffusion Plants.
Regulations in 10 CFR 70.23, Requirements for the approval of applications, apply to CFSI
because they require the applicant to demonstrate to the Commission that its proposed equipment and facilities are adequate to protect health and minimize danger to life or property.
Measures established by the applicant to satisfy 10 CFR 70.23 may aid in the prevention and detection of counterfeit and fraudulent equipment which could otherwise lead to a failure that could affect public health and safety.
Regulations in 10 CFR 70.39, Specific licenses for the manufacture or initial transfer of calibration or reference sources, contain requirements for calibration of reference sources, including requirements to perform tests on sources containing plutonium. Tests such as these may provide results that call into question the quality of a source and could potentially indicate CFSI.
QA programs directly apply to the identification and disposition of CFSI. Fuel cycle facilities are subject to quality-assurance requirements in 10 CFR 70.62(d), Management measures;
10 CFR 76.93, Quality assurance; Appendix B to 10 CFR Part 50; and other license conditions made either voluntarily or as a result of an NRC Order. Specifically, applicants and licensees for a uranium-enrichment and fuel-fabrication facility under 10 CFR Part 70 are required to establish and maintain a safety program that demonstrates compliance with 10 CFR 70.61, Performance requirements. The safety program includes management measures which are functions performed by the licensee to ensure that items relied on for safety are available and reliable to perform their functions when needed. Management measures such as maintenance, incident investigations, and other quality-assurance elements (which include elements such as inspections and tests) can be useful in identifying suspect items through evaluation of item quality before use, performance during use, and investigation of failures.
Further, fuel cycle facilities licensed under 10 CFR Parts 40, 70 and 76 implement elements of corrective action programs which may be applied to the identification, assessment, prevention, and resolution of CFSI issues at these facilities. Chapter 11 of NUREG 1520, Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility, Revision 1, and Chapter 15 of NUREG 1718, Standard Review Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility, provide guidance to applicants and licensees on the use of corrective actions as part of their management measures and/or quality assurance programs. Fuel cycle facility licensees may voluntarily implement corrective action programs that meet Regulatory Guide (RG) 3.75, Corrective Action Programs for Fuel Cycle Facilities (ADAMS Accession No. ML14139A321). Regulatory Guide 3.75 describes the programmatic elements of a corrective action program for fuel cycle facilities that the NRC considers acceptable for applying Section 2.3.2.a of the NRC Enforcement Policy. Applicants and licensees for the receipt, possession, and use of source and byproduct material under 10 CFR Part 40 do not have specific requirements related to quality assurance; however, certain facilities have conditions incorporated in their licensing basis to comply with the safety program requirements in 10 CFR Part 70. Certificate holders under 10 CFR Part 76 are required to comply with the quality-assurance criteria of ASME NQA-1-1989, "Quality Assurance Program Requirements for Nuclear Facilities," which contains elements that are analogous to the criteria in Appendix B to 10 CFR Part 50. Applicants and licensees for a plutonium-processing and fuel-fabrication facility under 10 CFR Part 70 are required to comply with the requirements of Appendix B to 10 CFR Part 50 for quality assurance. Activities performed under Appendix B to 10 CFR Part 50 include inspections, tests, procurement document control, and control of purchased material and equipment. These and other elements of Appendix B can provide evidence of potential counterfeit or fraudulent items through identification of poor or reduced quality, increased failure frequency, and inadequate documentation of material sourcing and item manufacture.
Reporting requirements in 10 CFR Parts 30, 40, 70, and 76 may also provide indication of CFSI
by identifying increased failure frequency and inadequate performance of items that may be associated with CFSI in the supply chain. Fuel cycle facility applicants, licensees, and certificate holders should remain aware of the correlation between existing regulatory requirements and opportunities to prevent the introduction of CFSI into, or to aid in the detection and removal of CFSI from, their facilities and activities.
RADIOACTIVE WASTE
Radioactive waste includes transportation, storage, and disposal of nuclear materials and waste, storage and transportation of spent nuclear fuel, and decommissioning of nuclear facilities.
Applicants and licensees for the packaging and transportation of radioactive material are required to establish and maintain programs and procedures that ensure public safety and demonstrate compliance with the regulatory requirements of 10 CFR Part 71, Packaging and Transportation of Radioactive Material. These regulatory requirements include management measures, packaging content, packaging evaluations, quality assurance, and transport conditional requirements.
These applicants and licensees are required to submit information about and maintain a quality assurance program that meets the requirements of Subpart H, Quality Assurance, of 10 CFR Part 71. Subpart H provides measures such as 10 CFR 71.115, Control of purchased material, equipment, and services; 10 CFR 71.117, Identification and control of materials, parts, and components; and 10 CFR 71.131, Nonconforming materials, parts, or components. These measures are analogous to criteria in Appendix B to 10 CFR Part 50.
Applicants, licensees, and certificate holders for the licensing of the independent storage of spent nuclear fuel, high-level waste, and reactor-related greater than Class C (GTCC) waste are required to establish and maintain programs and procedures to ensure public safety and demonstrate compliance with the regulatory requirements of 10 CFR Part 72, Licensing Requirements for the Independent Storage of Spent Nuclear Fuel, High-Level Radioactive Waste, and Reactor-Related Greater Than Class C Waste. These regulatory requirements include management measures, requirements, procedures, and criteria for the issuance of licenses to receive, transfer, and possess power-reactor spent fuel, power-reactor-related GTCC waste, and other radioactive materials associated with spent fuel storage in an independent spent fuel storage installation (ISFSI). The regulations in this part also establish requirements, procedures, and criteria for the issuance of Certificates of Compliance approving spent fuel storage cask designs.
Applicants, licensees, and certificate holders are required to submit information about a quality-assurance program that meets the requirements of Subpart G, Quality Assurance, to
10 CFR Part 72. Subpart G includes measures such as those of 10 CFR 72.154, Control of Purchased Material, Equipment, and Services; 10 CFR 71.156, Identification and control of materials, parts, and components; and 10 CFR 72.170, Nonconforming Materials, Parts, or Components. Again, these measures are analogous to criteria in Appendix B to 10 CFR Part 50.
The program elements of 10 CFR Part 71 and Part 72 discussed in this section, in conjunction with 10 CFR Part 21, provide the regulatory framework to prevent the use of suspect items. The NRC also conducts inspections of the licensees quality assurance program to verify compliance.
BACKFITTING AND ISSUE FINALITY DISCUSSION
This RIS discusses NRC regulations relevant to CFSI within the scope of NRCs regulatory jurisdiction.
This RIS does not set forth any new or changed NRC requirement, or new or changed guidance or position on compliance with any existing NRC regulatory requirement. The RIS does not require any action by any addressee, nor does this RIS request or suggest that any addressee submit information to the NRC which is not already required to be submitted by existing NRC
requirements (e.g., Part 21). For these reasons, this RIS does not represent backfitting as defined in 10 CFR 50.109(a)(1), 10 CFR 70.76, 10 CFR 72.62, 10 CFR 76.76, and is not otherwise inconsistent with any issue finality provision in 10 CFR Part 52. Therefore, the NRC
did not prepare a backfit analysis for this RIS or further address the issue finality criteria in Part
52.
FEDERAL REGISTER NOTIFICATION
The NRC published a notice of opportunity for public comment on this RIS in the Federal Register (79 FR 59521) on October 2, 2014. The agency received comments from eight commenters. The staff considered all comments, which resulted in minor clarifications to the RIS. The evaluation of these comments and the resulting changes to the RIS are discussed in a publicly available memorandum which is in ADAMS under Accession No. ML15008A192.
CONGRESSIONAL REVIEW ACT
This RIS is not a rule as defined in the Congressional Review Act (5 U.S.C. §§ 801-808).
RELATED GENERIC COMMUNICATIONS
AND OTHER NRC DOCUMENTS
GL 84-01, NRC Use of the Terms. Important to Safety and Safety Related (Generic Letter 84-01) (ADAMS Accession No. ML031150515).
GL 89-02, Actions to Improve the Detection of Counterfeit and Fraudulently Marketed Products (Agencywide Documents Access and Management System (ADAMS) Accession No. ML031140060).
GL 91-05, Licensee Commercial-Grade Procurement and Dedication Programs (ADAMS
Accession No. ML031140508).
IN 2008-04, Counterfeit Parts Supplied to Nuclear Power Plants (ADAMS Accession No. ML093620098).
IN 2012-22, Counterfeit, Fraudulent, Suspect Item (CFSI) Training Offerings (ADAMS
Accession No. ML12137A248).
IN 2013-02, Issues Potentially Affecting Nuclear Facility Fire Safety (ADAMS Accession No.
IN 2013-15, Willful Misconduct/Record Falsification and Nuclear Safety Culture (ADAMS
Accession No. ML13142A437).
NUREG 1022, Event Report Guidelines (ADAMS Accession No. ML13032A220).
NUREG/BR-0240, Reporting Safety Concerns To the NRC, (ADAMS Accession No.
Regulatory Guide 1.28, Quality Assurance Program Criteria (Design and Construction),
Revision 4, June 2010 (ADAMS Accession No. ML100160003).
Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation), Revision 3, June 2013 (ADAMS Accession No. ML13109A458).
Regulatory Guide 2.5, Quality Assurance Program Requirements for Research and Test Reactors, Revision 1, June 2011, (ADAMS Accession No. ML093520099).
Regulatory Guide 3.75, Corrective Action Programs for Fuel Cycle Facilities, June 2014 (ADAMS Accession No. ML14139A321).
SECY-94-277, Acceptance of Products Purchased for Use in Nuclear Power Plant Structures, Systems, and Components, (ADAMS Accession No. ML14268A013).
PAPERWORK REDUCTION ACT STATEMENT
This RIS does not contain new or amended information collection requirements that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing requirements were approved by the Office of Management and Budget, approval numbers 3150-0035, 3150-0017,
3150-0001, 3150-0020, 3150-0011, 3150-0009, 3150-0008, 3150-0132, and 3150-0002.
PUBLIC PROTECTION NOTIFICATION
The NRC may not conduct or sponsor, and a person is not required to respond to, an information collection unless the requesting document displays a currently valid OMB control number.
CONTACT
Please direct any questions about this matter to the technical contacts listed below.
/RA/ /RA/
Michael C. Cheok, Director Lawrence E. Kokajko, Director Division of Construction Inspection Division of Policy and Rulemaking and Operational Program Office of Nuclear Reactor Regulation Office of New Reactors
/RA/ /RA/
Josephine M. Piccone, Director Barry C. Westreich, Director Division of Material Safety, State, Tribal Cyber Security Directorate and Rulemaking Programs Office of Nuclear Security Office of Nuclear Material Safety and Incident Response and Safeguards Technical Contacts: Daniel Pasquale, NRO/DCIP/IGCB
(301) 415-2498 E-mail: Daniel.Pasquale@nrc.gov James Gaslevic, NRO/DCIP/IGCB
(301) 415-2776 E-mail: James.Gaslevic@nrc.gov Note: NRC generic communications may be found on the NRC public Web site, http://www.nrc.gov, under NRC Library/Document Collections.
ML15008A191 *via email TAC MF4394 OFFICE NRO/DCIP/IGCB NRO/DCIP/IGCB NRR/DIRS/IOEB NMSS/MSTR/MSLB NMSS/FCSS/PORSB NMSS/DSFST/RIOB NSIR/CSD
NAME JGaslevic* DPasquale* DGarmon* THerrera* JCintron* CMorell* RLi*
03/03/15 03/04/15 03/10/15 03/04/15 03/10/15 03/06/15 03/03/15 DATE
BC:NRO/DCIP/I BC:NMSS/MSTR/ BC:NMSS/FCSS/ BC:NMSS/DSFST/
OFFICE BC:NRR/DIRS/IOEB DD: NSIR/CSD OE/EB
GCB MSLB PORSB RIOB
HChernoff (EThomas NAME BAnderson* for)* HGonzalez* MKotzalas* PSilva* RFelts* RFretz*
DATE 03/17/15 03/26/15 03/11/15 03/17/15 03/06/15 03/17/15 04/01/15 OFFICE NRR/PMDA OIS D: NRR/DORL D: NRR/DIRS D: NRO/DCIP D: NSIR/CSD D: NMSS/FCSS
NAME LHilll* TDonnell* LLund* AHowe* MCheok* BWestreich* MBailey*
DATE 03/16/15 03/17/15 04/08/15 04/07/15 04/02/15 04/08/15 04/08/15 OFFICE D: NMSS/SFST D:NMSS/MSTR OGC NLO LA: NRR/PGCB PM:NRR/PGCB BC: NRR/PGCB D:NRR/DPR
LDudes (DBollock NAME MLombard* JBiggins* ELee TMensah SStuchell AMohseni for)*
DATE 03/06/15 0408/15 05/18/15 06/15/15 06/16/15 06/16/15 06/16/15 OFFICE D:NRR/DPR
NAME LKokajko DATE 06/24 /15