ML18243A135

Enclosure 3 - Information Protection Requirements for Safeguards Information

ML18243A135
Person / Time
Issue date:	08/30/2018
From:	Office of Nuclear Material Safety and Safeguards
To:
Lynch J
Shared Package
ML18243A132	List: ML18243A133 ML18243A135 ML18260A276
References
Download: ML18243A135 (11)

Text

470 10 CFR Ch. I (1-1-18 Edition)

§ 73.20 (b) The approved information collec-tion requirements contained in this part appear in §§ 73.5, 73.20, 73.21, 73.23, 73.24, 73.25, 73.26, 73.27, 73.37, 73.38, 73.40, 73.45, 73.46, 73.50, 73.51, 73.54, 73.55, 73.56, 73.57, 73.58, 73.60, 73.67, 73.70, 73.71, 73.72, 73.73, 73.74, and appendices B, C, and G to this part.

(c) This part contains information collection requirements in addition to those approved under the control num-ber specified in paragraph (a) of this section. The information collection re-quirement and the control numbers under which it is approved are as fol-lows:

(1) In §§ 73.71 and 73.77, NRC Form 366 is approved under control number 3150-0104.

(2) [Reserved]

[62 FR 52189, Oct. 6, 1997, as amended at 67 FR 67101, Nov. 4, 2002; 73 FR 63574, Oct. 24, 2008; 74 FR 13970, Mar. 27, 2009; 77 FR 39909, July 6, 2012; 78 FR 29550, May 20, 2013; 80 FR 67275, Nov. 2, 2015; 80 FR 74981, Dec. 1, 2015]

§ 73.20 General performance objective and requirements.

(a) In addition to any other require-ments of this part, each licensee who is authorized to operate a fuel reprocess-ing plant pursuant to part 50 of this chapter; possesses or uses formula quantities of strategic special nuclear material at any site or contiguous sites subject to control by the licensee; is authorized to transport or deliver to a carrier for transportation pursuant to part 70 of this chapter formula quan-tities of strategic special nuclear mate-rial; takes delivery of formula quan-tities of strategic special nuclear mate-rial free on board (f.o.b.) the point at which it is delivered to a carrier for transportation; or imports or exports formula quantities of strategic special nuclear material, shall establish and maintain or make arrangements for a physical protection system which will have as its objective to provide high as-surance that activities involving spe-cial nuclear material are not inimical to the common defense and security, and do not constitute an unreasonable risk to the public health and safety.

The physical protection system shall be designed to protect against the de-sign basis threats of theft or diversion of strategic special nuclear material and radiological sabotage as stated in

§ 73.1(a).

(b) To achieve the general perform-ance objective of paragraph (a) of this section a licensee shall establish and maintain, or arrange for, a physical protection system that:

(1) Provides the performance capa-bilities described in § 73.25 for in-transit protection or in § 73.45 for fixed site protection unless otherwise authorized by the Commission; (2) Is designed with sufficient redun-dancy and diversity to ensure mainte-nance of the capabilities described in

§§ 73.25 and 73.45; (3) Includes a safeguards contingency capability that can meet the criteria in appendix C to this part Licensee Safe-guards Contingency Plans; and (4) Includes a testing and mainte-nance program to assure control over all activities and devices affecting the effectiveness, reliability, and avail-ability of the physical protection sys-tem, including a demonstration that any defects of such activities and de-vices will be promptly detected and corrected for the total period of time they are required as a part of the phys-ical protection system.

(c) Each licensee subject to the re-quirements of paragraphs (a) and (b) of this section shall establish, maintain, and follow NRC-approved safeguards physical protection and safeguards con-tingency plans that describe how the licensee will comply with the require-ments of paragraphs (a) and (b) of this section.

[44 FR 68188, Nov. 28, 1979, as amended at 57 FR 33430, July 29, 1992]

§ 73.21 Protection of Safeguards Infor-mation: Performance requirements.

(a) General performance requirement.

(1) Each licensee, certificate holder, ap-plicant, or other person who produces, receives, or acquires Safeguards Infor-mation (including Safeguards Informa-tion with the designation or marking:

Safeguards InformationModified Handling) shall ensure that it is pro-tected against unauthorized disclosure.

To meet this general performance re-quirement, such licensees, certificate holders, applicants, or other persons subject to this section shall:

VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00480 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

471 Nuclear Regulatory Commission

§ 73.22 (i) Establish, implement, and main-tain an information protection system that includes the applicable measures for Safeguards Information specified in

§ 73.22 related to: Power reactors; a for-mula quantity of strategic special nu-clear material; transportation of or de-livery to a carrier for transportation of a formula quantity of strategic special nuclear material or more than 100 grams of irradiated reactor fuel; ura-nium hexafluoride production or con-version facilities; fuel fabrication fa-cilities; uranium enrichment facilities; independent spent fuel storage instal-lations; and geologic repository oper-ations areas.

(ii) Establish, implement, and main-tain an information protection system that includes the applicable measures for Safeguards Information specified in

§ 73.23 related to: Research and test re-actors that possess special nuclear ma-terial of moderate strategic signifi-cance or special nuclear material of low strategic significance.

(iii) Protect the information in ac-cordance with the requirements of

§ 73.22 if the Safeguards Information is not described in paragraphs (a)(1)(i) and (a)(1)(ii) of this section.

(2) Information protection procedures employed by Federal, State, Tribal, and local law enforcement agencies are presumed to meet the general perform-ance requirement in paragraph (a)(1) of this section.

(b) Commission authority. (1) Pursuant to Section 147 of the Atomic Energy Act of 1954, as amended, the Commis-sion may impose, by order or regula-tion, Safeguards Information protec-tion requirements different from or in addition to those specified in this Part on any person who produces, receives, or acquires Safeguards Information.

(2) The Commission may require, by regulation or order, that information within the scope of Section 147 of the Atomic Energy Act of 1954, as amend-ed, related to facilities or materials not specifically described in §§ 73.21, 73.22 or 73.23 be protected under this part.

[73 FR 63574, Oct. 24, 2008, as amended at 77 FR 34205, June 11, 2012; 79 FR 58671, Sept. 30, 2014]

§ 73.22 Protection of Safeguards Infor-mation: Specific requirements.

This section contains specific re-quirements for the protection of Safe-guards Information in the hands of any person subject to the requirements of

§ 73.21(a)(1)(i) and related to power re-actors; a formula quantity of strategic special nuclear material; transpor-tation of or delivery to a carrier for transportation of a formula quantity of strategic special nuclear material or more than 100 grams of irradiated reac-tor fuel; uranium hexafluoride produc-tion or conversion facilities, fuel fab-rication facilities, and uranium enrich-ment facilities; independent spent fuel storage installations; geologic reposi-tory operations areas and Safeguards Information in the hands of any person subject to the requirements of

§ 73.21(a)(1)(iii).

(a) Information to be protected. The types of information and documents that must be protected as Safeguards Information include non-public secu-rity-related requirements such as:

(1) Physical protection. Information not classified as Restricted Data or Na-tional Security Information related to physical protection, including:

(i) The composite physical security plan for the facility or site; (ii) Site-specific drawings, diagrams, sketches, or maps that substantially represent the final design features of the physical security system not easily discernible by members of the public; (iii) Alarm system layouts showing the location of intrusion detection de-vices, alarm assessment equipment, alarm system wiring, emergency power sources for security equipment, and du-ress alarms not easily discernible by members of the public; (iv) Physical security orders and pro-cedures issued by the licensee for mem-bers of the security organization de-tailing duress codes, patrol routes and schedules, or responses to security con-tingency events; (v) Site-specific design features of plant security communications sys-tems; (vi) Lock combinations, mechanical key design, or passwords integral to the physical security system; VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00481 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

472 10 CFR Ch. I (1-1-18 Edition)

§ 73.22 (vii) Documents and other matter that contain lists or locations of cer-tain safety-related equipment explic-itly identified in the documents or other matter as vital for purposes of physical protection, as contained in se-curity plans, contingency measures, or plant specific safeguards analyses; (viii) The composite safeguards con-tingency plan/measures for the facility or site; (ix) The composite facility guard qualification and training plan/meas-ures disclosing features of the physical security system or response proce-dures; (x) Information relating to on-site or off-site response forces, including size, armament of response forces, and ar-rival times of such forces committed to respond to security contingency events; (xi) The adversary characteristics document and related information, in-cluding implementing guidance associ-ated with the Design Basis Threat in

§ 73.1(a)(1) or (a)(2); and (xii) Engineering and safety analyses, security-related procedures or sce-narios, and other information revealing site-specific details of the facility or materials if the unauthorized disclo-sure of such analyses, procedures, sce-narios, or other information could rea-sonably be expected to have a signifi-cant adverse effect on the health and safety of the public or the common de-fense and security by significantly in-creasing the likelihood of theft, diver-sion, or sabotage of source, byproduct, or special nuclear material.

(2) Physical protection in transit. Infor-mation not classified as Restricted Data or National Security Information related to the transportation of, or de-livery to a carrier for transportation of a formula quantity of strategic special nuclear material or more than 100 grams of irradiated reactor fuel, in-cluding:

(i) The composite physical security plan for transportation; (ii) Schedules and itineraries for spe-cific shipments of source material, by-product material, high-level nuclear

waste, or irradiated reactor fuel.

Schedules for shipments of source ma-terial, byproduct material, high-level nuclear waste, or irradiated reactor fuel are no longer controlled as Safe-guards Information 10 days after the last shipment of a current series; (iii) Vehicle immobilization features, intrusion alarm devices, and commu-nications systems; (iv) Arrangements with and capabili-ties of local police response forces, and locations of safe havens identified along the transportation route; (v) Limitations of communications during transport; (vi) Procedures for response to secu-rity contingency events; (vii) Information concerning the tac-tics and capabilities required to defend against attempted sabotage, or theft and diversion of formula quantities of special nuclear material, irradiated re-actor fuel, or related information; and (viii) Engineering or safety analyses, security-related procedures or sce-narios and other information related to the protection of the transported mate-rial if the unauthorized disclosure of such analyses, procedures, scenarios, or other information could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and se-curity by significantly increasing the likelihood of theft, diversion, or sabo-tage of source, byproduct, or special nuclear material.

(3) Inspections, audits and evaluations.

Information not classified as National Security Information or Restricted Data pertaining to safeguards and se-curity inspections and reports, includ-ing:

(i) Portions of inspection reports, evaluations, audits, or investigations that contain details of a licensees or applicants physical security system or that disclose uncorrected

defects, weaknesses, or vulnerabilities in the system. Disclosure of corrected defects, weaknesses, or vulnerabilities is sub-ject to an assessment taking into ac-count such factors as trending analyses and the impacts of disclosure on licens-ees having similar physical security systems; and (ii) Reports of investigations con-taining general information may be re-leased after corrective actions have been completed, unless withheld pursu-ant to other authorities, e.g., the Free-dom of Information Act (5 U.S.C. 552).

VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00482 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

473 Nuclear Regulatory Commission

§ 73.22 (4) Correspondence. Portions of cor-respondence insofar as they contain Safeguards Information as set forth in paragraphs (a)(1) through (a)(3) of this section.

(5) Other information within the scope of Section 147 of the Atomic En-ergy Act of 1954, as amended, that the Commission determines by order or regulation could reasonably be ex-pected to have a significant adverse ef-fect on the health and safety of the public or the common defense and se-curity by significantly increasing the likelihood of theft, diversion, or sabo-tage of source, byproduct, or special nuclear material or a facility.

(b) Conditions for access. (1) Except as the Commission may otherwise author-ize, no person may have access to Safe-guards Information unless the person has an established need to know for the information and has undergone a Federal Bureau of Investigation (FBI) criminal history records check using the procedures set forth in § 73.57.

(2) In addition, a person to be granted access to Safeguards Information must be trustworthy and reliable, based on a background check or other means ap-proved by the Commission.

(3) The categories of individuals spec-ified in 10 CFR 73.59 are exempt from the criminal history records check and background check requirements in paragraphs (b)(1) and (b)(2) of this sec-tion by virtue of their occupational status.

(4) For persons participating in an NRC adjudicatory proceeding, the need to know determination shall be made by the originator of the Safe-guards Information upon receipt of a request for access to the Safeguards In-formation. Where the information is in the possession of the originator and the NRC staff, whether in its original form or incorporated into another document or other matter by the recipient, the NRC staff shall make the determina-tion. In the event of a dispute regard-ing the need to know determination, the presiding officer of the proceeding shall determine whether the need to know findings in § 73.2 can be made.

(5) Except as the Commission may otherwise authorize, no person may disclose Safeguards Information to any other person except as set forth in this section.

(c) Protection while in use or storage.

(1) While in use, matter containing Safeguards Information must be under the control of an individual authorized access to Safeguards Information. This requirement is satisfied if the Safe-guards Information is attended by such an individual even though the informa-tion is in fact not constantly being used. Safeguards Information within alarm stations, or rooms continuously occupied by authorized individuals need not be stored in a locked security storage container.

(2) While unattended, Safeguards In-formation must be stored in a locked security storage container. The con-tainer shall not identify the contents of the matter contained and must pre-clude access by individuals not author-ized access in accordance with the pro-visions of this section. Knowledge of lock combinations protecting Safe-guards Information must be limited to a minimum number of personnel for op-erating purposes who have a need to know and are otherwise authorized access to Safeguards Information in ac-cordance with the provisions of this Part. Access to lock combinations must be strictly controlled so as to prevent disclosure to an individual not authorized access to Safeguards Infor-mation.

(d) Preparation and marking of docu-ments or other matter. (1) Each docu-ment or other matter that contains Safeguards Information as described in

§ 73.21(a)(1)(i) and this section must be marked to indicate the presence of such information in a conspicuous manner on the top and bottom of each page. The first page of the document or other matter must also contain:

(i) The name, title, and organization of the individual authorized to make a Safeguards Information determination, and who has determined that the docu-ment or other matter contains Safe-guards Information; (ii) The date the determination was made; and (iii) An indication that unauthorized disclosure will be subject to civil and criminal sanctions.

(2) In addition to the markings at the top and bottom of each page, any VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00483 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

474 10 CFR Ch. I (1-1-18 Edition)

§ 73.22 transmittal letters or memoranda to or from the NRC which do not in them-selves contain Safeguards Information shall be marked to indicate that at-tachments or enclosures contain Safe-guards Information but that the trans-mittal document or other matter does not (i.e., When separated from Safe-guards Information enclosure(s), this document is decontrolled provided the transmittal document does not other-wise warrant protection from unau-thorized disclosure).

(3) Any transmittal document or other matter forwarding Safeguards In-formation must alert the recipient that protected information is enclosed. Cer-tification that a document or other matter contains Safeguards Informa-tion must include the name and title of the certifying official and date des-ignated. Portion marking is required only for correspondence to and from the NRC (i.e., cover letters, but not at-tachments) that contains Safeguards Information.

The portion marking must be sufficient to allow the recipi-ent to identify and distinguish those sections of the transmittal document or other information containing the Safeguards Information from non-Safe-guards Information.

(4) Marking of documents or other matter containing or transmitting Safeguards Information shall, at a min-imum include the words Safeguards Information to ensure identification of protected information for the pro-tection of facilities and material cov-ered by § 73.22.

(e) Reproduction of matter containing Safeguards Information. Safeguards In-formation may be reproduced to the minimum extent necessary consistent with need without permission of the originator. Equipment used to repro-duce Safeguards Information must be evaluated to ensure that unauthorized individuals cannot access Safeguards Information (e.g., unauthorized indi-viduals cannot access Safeguards Infor-mation by gaining access to retained memory or network connectivity).

(f) External transmission of documents and material. (1) Documents or other matter containing Safeguards Informa-tion, when transmitted outside an au-thorized place of use or storage, must be packaged in two sealed envelopes or wrappers to preclude disclosure of the presence of protected information. The inner envelope or wrapper must con-tain the name and address of the in-tended recipient and be marked on both sides, top and bottom, with the words Safeguards Information. The outer envelope or wrapper must be opaque, addressed to the intended re-cipient, must contain the address of the sender, and may not bear any markings or indication that the docu-ment or other matter contains Safe-guards Information.

(2) Safeguards Information may be transported by any commercial deliv-ery company that provides service with computer tracking features, U.S. first class, registered, express, or certified mail, or by any individual authorized access pursuant to these requirements.

(3) Except under emergency or ex-traordinary conditions, Safeguards In-formation shall be transmitted outside an authorized place of use or storage only by NRC approved secure elec-tronic devices, such as facsimiles or telephone devices, provided that trans-mitters and receivers implement proc-esses that will provide high assurance that Safeguards Information is pro-tected before and after the trans-mission or electronic mail through the internet, provided that the information is encrypted by a method (Federal In-formation Processing Standard [FIPS]

140-2 or later) approved by the appro-priate NRC Office; the information is produced by a self contained secure automatic data process system; and transmitters and receivers implement the information handling processes that will provide high assurance that Safeguards Information is protected before and after transmission. Physical security events required to be reported pursuant to § 73.71 are considered to be extraordinary conditions. Cyber secu-rity event notifications required to be reported pursuant to § 73.77 are consid-ered to be extraordinary conditions.

(g) Processing of Safeguards Informa-tion on electronic systems. (1) Safeguards Information may be stored, processed or produced on a stand-alone computer (or computer system) for processing of Safeguards Information. Stand-alone means a computer or computer system VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00484 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

475 Nuclear Regulatory Commission

§ 73.23 to which access is limited to individ-uals authorized access to Safeguards Information. A stand-alone computer or computer system shall not be phys-ically or in any other way connected to a network accessible by users who are not authorized access to Safeguards In-formation.

(2) Each computer not located within an approved and lockable security stor-age container that is used to process Safeguards Information must have a removable storage medium with a bootable operating system.

The bootable operating system must be used to load and initialize the com-puter. The removable storage medium must also contain the software applica-tion programs. Data may be saved on either the removable storage medium that is used to boot the operating sys-tem, or on a different removable stor-age medium. The removable storage medium must be secured in a locked security storage container when not in use.

(3) A mobile device (such as a laptop computer) may also be used for the processing of Safeguards Information provided the device is secured in a locked security storage container when not in use. Other systems may be used if approved for security by the appro-priate NRC office.

(4) Any electronic system that has been used for storage, processing or production of Safeguards Information must be free of recoverable Safeguards Information prior to being returned to nonexclusive use.

(h) Removal from Safeguards Informa-tion category. Documents or other mat-ter originally containing Safeguards Information must be removed from the Safeguards Information category at such time as the information no longer meets the criteria contained in this part. Care must be exercised to ensure that any document or other matter de-controlled not disclose Safeguards In-formation in some other form or be combined with other unprotected infor-mation to disclose Safeguards Informa-tion. The authority to determine that a document or other matter may be de-controlled will only be exercised by the NRC, with NRC approval, or in con-sultation with the individual or organi-zation that made the original deter-mination.

(i) Destruction of matter containing Safeguards Information. Documents or other matter containing Safeguards In-formation shall be destroyed when no longer needed. The information can be destroyed by burning, shredding or any other method that precludes recon-struction by means available to the public at large. Piece sizes no wider than one quarter inch composed of sev-eral pages or documents and thor-oughly mixed are considered com-pletely destroyed.

[73 FR 63574, Oct. 24, 2008, as amended at 80 FR 67275, Nov. 2, 2015]

§ 73.23 Protection of Safeguards Infor-mationModified Handling:

Spe-cific requirements.

This section contains specific re-quirements for the protection of Safe-guards Information in the hands of any person subject to the requirements of

§ 73.21(a)(1)(ii) and research and test re-actors that possess special nuclear ma-terial of moderate strategic signifi-cance or special nuclear material of low strategic significance. The require-ments of this section distinguish Safe-guards Information requiring modified handling requirements (SGI-M) from the specific Safeguards Information handling requirements applicable to fa-cilities and materials needing a higher level of protection, as set forth in

§ 73.22.

(a) Information to be protected. The types of information and documents that must be protected as Safeguards InformationModified Handling in-clude non-public security-related re-quirements such as protective meas-ures, interim compensatory measures, additional security measures, and the following, as applicable:

(1) Physical protection. Information not classified as Restricted Data or Na-tional Security Information related to physical protection, including:

(i) The composite physical security plan for the facility or site; (ii) Site specific drawings, diagrams, sketches, or maps that substantially represent the final design features of the physical security system not easily discernible by members of the public; VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00485 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

476 10 CFR Ch. I (1-1-18 Edition)

§ 73.23 (iii) Alarm system layouts showing the location of intrusion detection de-vices, alarm assessment equipment, alarm system wiring, emergency power sources for security equipment, and du-ress alarms not easily discernible by members of the public; (iv) Physical security orders and pro-cedures issued by the licensee for mem-bers of the security organization de-tailing duress codes, patrol routes and schedules, or responses to security con-tingency events; (v) Site specific design features of plant security communications sys-tems; (vi) Lock combinations, mechanical key design, or passwords integral to the physical security system; (vii) The composite facility guard qualification and training plan/meas-ures disclosing features of the physical security system or response proce-dures; (viii) Descriptions of security activi-ties which disclose features of the physical security system or response measures; (ix) Information relating to onsite or offsite response forces, including size, armament of the response forces, and arrival times of such forces committed to respond to security contingency events; and (x) Engineering and safety analyses, security-related procedures or sce-narios, and other information revealing site-specific details of the facility or materials if the unauthorized disclo-sure of such analyses, procedures, sce-narios, or other information could rea-sonably be expected to have a signifi-cant adverse effect on the health and safety of the public or the common de-fense and security by significantly in-creasing the likelihood of theft, diver-sion, or sabotage of source, byproduct, or special nuclear material.

(2) Physical protection in transit. Infor-mation not classified as Restricted Data or National Security Information related to the physical protection of shipments of special nuclear material in less than a formula quantity (except for those materials covered under

§ 73.22), including:

(i) Information regarding transpor-tation security measures, including physical security plans and procedures, immobilization devices, and escort re-quirements, more detailed than NRC regulations; (ii) Scheduling and itinerary infor-mation for shipments (scheduling and itinerary information for shipments that are inherently self-disclosing, such as a shipment that created exten-sive news coverage or an announce-ment by a public official confirming re-ceipt, may be decontrolled after ship-ment departure).

Scheduling and itinerary information for shipments that are not inherently self-disclosing may be decontrolled 2 days after the shipment is completed. Scheduling and itinerary information used for the pur-pose of preplanning, coordination, and advance notification may be shared with others on a need to know basis and need not be designated as Safe-guards Information-Modified Han-dling);

(iii) Arrangements with and capabili-ties of local police response forces, and locations of safe havens identified along the transportation route; (iv) Details of alarm and communica-tion systems, communication proce-dures, and duress codes; (v) Procedures for response to secu-rity contingency events; and (vi) Engineering or safety analyses, security-related procedures or sce-narios and other information related to the protection of the transported mate-rial if the unauthorized disclosure of such analyses, procedures, scenarios, or other information could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and se-curity by significantly increasing the likelihood of theft, diversion, or sabo-tage of source, byproduct, or special nuclear material.

(3) Inspections, audits and evaluations.

Information not classified as National Security Information or Restricted Data pertaining to safeguards and se-curity inspections and reports, includ-ing:

(i) Portions of inspection reports, evaluations, audits, or investigations that contain details of a licensees or applicants physical security system or that disclose uncorrected

defects, weaknesses, or vulnerabilities in the system. Disclosure of corrected defects, VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00486 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

477 Nuclear Regulatory Commission

§ 73.23 weaknesses, or vulnerabilities is sub-ject to an assessment taking into ac-count such factors as trending analyses and the impacts of disclosure on licens-ees having similar physical security systems; and (ii) Reports of investigations con-taining general information may be re-leased after the corrective actions have been completed, unless withheld pursu-ant to other authorities, e.g., the Free-dom of Information Act (5 U.S.C. 552).

(4) Correspondence. Portions of cor-respondence insofar as they contain Safeguards Information designated as Safeguards Information-Modified Han-dling, as set forth in paragraphs (a)(1) through (a)(3) of this section.

(5) Other information within the scope of Section 147 of the Atomic En-ergy Act of 1954, as amended, that the Commission determines by order or regulation could reasonably be ex-pected to have a significant adverse ef-fect on the health and safety of the public or the common defense and se-curity by significantly increasing the likelihood of theft, diversion, or sabo-tage of source, byproduct, or special nuclear material or a facility.

(b) Conditions for access. (1) Except as the Commission may otherwise author-ize, no person may have access to Safe-guards Information designated as Safe-guards Information-Modified Handling unless the person has an established need to know for the information and has undergone a Federal Bureau of Investigation criminal history records check using the procedures set forth in

§ 73.57.

(2) In addition, a person to be granted access to Safeguards Information must be trustworthy and reliable, based on a background check or other means ap-proved by the Commission.

(3) The categories of individuals spec-ified in 10 CFR 73.59 are exempt from the criminal history records check and background check requirements in paragraphs (b)(1) and (b)(2) of this sec-tion by virtue of their occupational status:

(4) For persons participating in an NRC adjudicatory proceeding, the need to know determination shall be made by the originator of the Safe-guards Information designated as Safe-guards Information-Modified Handling upon receipt of a request for access to the Safeguards Information designated as Safeguards Information-Modified Handling. Where the information is in the possession of the originator and the NRC staff, whether in its original form or incorporated into another document or other matter by the recipient, the NRC staff shall make the determina-tion. In the event of a dispute regard-ing the need to know determination, the presiding officer of the proceeding shall determine whether the need to know findings in § 73.2 can be made.

(5) Except as the Commission may otherwise authorize, no person may disclose Safeguards Information des-ignated as Safeguards Information-Modified Handling to any other person except as set forth in this section.

(c) Protection while in use or storage.

(1) While in use, matter containing Safeguards Information designated as Safeguards Information-Modified Han-dling must be under the control of an individual authorized access to such in-formation. This requirement is satis-fied if the Safeguards Information des-ignated as Safeguards Information-Modified Handling is attended by such an individual even though the informa-tion is in fact not constantly being used.

Safeguards Information des-ignated as Safeguards Information-Modified Handling within alarm sta-tions, or rooms continuously occupied by authorized individuals, need not be locked in a file drawer or cabinet.

(2) While unattended, Safeguards In-formation designated as Safeguards In-formation-Modified Handling must be stored in a locked file drawer or cabi-net. The container shall not identify the contents of the matter contained and must preclude access by individ-uals not authorized access in accord-ance with the provisions of this sec-tion. Knowledge of lock combinations or access to keys protecting Safeguards Information designated as Safeguards Information-Modified Handling must be limited to a minimum number of personnel for operating purposes who have a need to know and are other-wise authorized access to Safeguards Information in accordance with the provisions of this Part. Access to lock combinations must be strictly con-trolled so as to prevent disclosure to an VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00487 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

478 10 CFR Ch. I (1-1-18 Edition)

§ 73.23 individual not authorized access to Safeguards Information designated as Safeguards Information-Modified Han-dling.

(d) Preparation and marking of docu-ments or other matter. (1) Each docu-ment or other matter that contains Safeguards Information designated as Safeguards Information-Modified Han-dling as described in § 73.23(a) and in this section must be marked to indi-cate the presence of Safeguards Infor-mation with modified handling require-ments in a conspicuous manner on the top and bottom of each page. The first page of the document or other matter must also contain:

(i) The name, title, and organization of the individual authorized to make a Safeguards Information designated as Safeguards Information-Modified Han-dling determination, and who has de-termined that the document or other matter contains Safeguards Informa-tion designated as Safeguards Informa-tion-Modified Handling; (ii) The date the determination was made; and (iii) An indication that unauthorized disclosure will be subject to civil and criminal sanctions.

(2) In addition to the markings at the top and bottom of each page, any transmittal letters or memoranda to or from the NRC which do not in them-selves contain Safeguards Information designated as Safeguards Information-Modified Handling shall be marked to indicate that attachments or enclo-sures contain Safeguards Information designated as Safeguards Information-Modified Handling but that the trans-mittal document does not (i.e., When separated from Safeguards Information designated as Safeguards Information-Modified Handling enclosure(s), this document is decontrolled provided the transmittal document does not other-wise warrant protection from unau-thorized disclosure).

(3) Any transmittal document or other matter forwarding Safeguards In-formation designated as Safeguards In-formation-Modified Handling must alert the recipient that protected infor-mation is enclosed. Certification that a document or other matter contains Safeguards Information designated as Safeguards Information-Modified Han-dling must include the name and title of the certifying official and date des-ignated. Portion marking is required only for correspondence to and from the NRC (i.e., cover letters, but not at-tachments) that contains Safeguards Information designated as Safeguards Information-Modified Handling.

The portion marking must be sufficient to allow the recipient to identify and dis-tinguish those sections of the trans-mittal document or other information containing the Safeguards Information from non-Safeguards Information.

(4) Marking of documents or other matter containing or transmitting Safeguards Information with modified handling requirements shall, at a min-imum include the words Safeguards Information-Modified Handling to en-sure identification of protected infor-mation for the protection of facilities and material covered by § 73.23.

(e) Reproduction of matter containing Safeguards Information designated as Safeguards Information-Modified Han-dling.

Safeguards Information des-ignated as Safeguards Information-Modified Handling may be reproduced to the minimum extent necessary, con-sistent with need, without permission of the originator. Equipment used to reproduce Safeguards Information des-ignated as Safeguards Information-Modified Handling must be evaluated to ensure that unauthorized individ-uals cannot access the information (e.g., unauthorized individuals cannot access Safeguards Information by gain-ing access to retained memory or net-work connectivity).

(f) External transmission of documents and material. (1) Documents or other matter containing Safeguards Informa-tion designated as Safeguards Informa-tion-Modified Handling, when trans-mitted outside an authorized place of use or storage, must be packaged in two sealed envelopes or wrappers to preclude disclosure of the presence of protected information. The inner enve-lope or wrapper must contain the name and address of the intended recipient and be marked on both sides, top and bottom, with the words Safeguards Information-Modified Handling. The outer envelope or wrapper must be opaque, addressed to the intended re-cipient, must contain the address of VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00488 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

479 Nuclear Regulatory Commission

§ 73.23 the sender, and may not bear any markings or indication that the docu-ment contains Safeguards Information designated as Safeguards Information-Modified Handling.

(2)

Safeguards Information des-ignated Safeguards Information-Modi-fied Handling may be transported by any commercial delivery company that provides service with computer track-ing features, U.S. first class, reg-istered, express, or certified mail, or by any individual authorized access pursu-ant to these requirements.

(3) Except under emergency or ex-traordinary conditions, Safeguards In-formation designated as Safeguards In-formation-Modified Handling must be transmitted electronically only by pro-tected telecommunications circuits (including facsimile) or encryption by a method (Federal Information Proc-essing Standard [FIPS] 140-2 or later) approved by the appropriate NRC of-fice. For the purpose of this section, emergency or extraordinary conditions are defined as any circumstances that require immediate communications in order to report, summon assistance for, or respond to a security contingency event or an event that has potential se-curity significance. Physical security events required to be reported pursuant to § 73.71 are considered to be extraor-dinary conditions.

(g) Processing of Safeguards Informa-tion-Modified Handling on electronic sys-tems. (1) Safeguards Information des-ignated for modified handling may be stored, processed or produced on a com-puter or computer system, provided that the system is assigned to the li-censees or contractors facility. Safe-guards Information designated as Safe-guards Information-Modified Handling files must be protected, either by a password or encryption, to prevent un-authorized individuals from gaining ac-cess. Word processors such as type-writers are not subject to these re-quirements as long as they do not transmit information off-site.

NOTE:

If Safeguards Information des-ignated as Safeguards Information-Modified Handling is produced on a typewriter, the ribbon must be properly marked and be re-moved and stored in the same manner as other Safeguards Information designated as Safeguards Information-Modified Handling.

(2)

Safeguards Information des-ignated as Safeguards Information-Modified Handling files may be trans-mitted over a network if the file is encrypted. In such cases, the licensee will select a commercially available encryption system that the National Institute of Standards and Technology (NIST) has validated as conforming to Federal Information Processing Stand-ards (FIPS) 140-2 or later. Safeguards Information designated as Safeguards Information-Modified Handling files shall be properly labeled to indicate the presence of Safeguards Information with modified handling requirements and saved to removable matter and stored in a locked file drawer or cabi-net.

(3) A mobile device (such as a laptop computer) may also be used for the processing of Safeguards Information designated as Safeguards Information-Modified Handling provided the device is secured in an appropriate locked storage container when not in use.

Other systems may be used if approved for security by the appropriate NRC of-fice.

(4) Any electronic system that has been used for storage, processing or production of Safeguards Information must be free of recoverable Safeguards Information designated as Safeguards Information-Modified Handling prior to being returned to nonexclusive use.

(h) Removal from Safeguards Informa-tion-Modified Handling category. Docu-ments or other matter originally con-taining Safeguards Information des-ignated as Safeguards Information-Modified Handling must be removed from the Safeguards Information cat-egory at such time as the information no longer meets the criteria contained in this Part. Care must be exercised to ensure that any document or other matter decontrolled shall not disclose Safeguards Information in some other form or be combined with other unpro-tected information to disclose Safe-guards Information. The authority to determine that a document or other matter may be decontrolled will only be exercised by the NRC, with NRC ap-proval, or in consultation with the in-dividual or organization that made the original determination.

VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00489 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031

480 10 CFR Ch. I (1-1-18 Edition)

§ 73.24 (i) Destruction of matter containing Safeguards Information designated as Safeguards Information-Modified Han-dling. Documents or other matter con-taining Safeguards Information shall be destroyed when no longer needed.

The information can be destroyed by burning, shredding, or any other meth-od that precludes reconstruction by means available to the public at large.

Piece sizes no wider than one quarter inch composed of several pages or doc-uments and thoroughly mixed are con-sidered completely destroyed.

[73 FR 63577, Oct. 24, 2008]

§ 73.24 Prohibitions.

(a) Except as specifically approved by the Nuclear Regulatory Commission, no shipment of special nuclear mate-rial shall be made in passenger aircraft in excess of (1) 20 grams or 20 curies, whichever is less, of plutonium or ura-nium-233, or (2) 350 grams of uranium-235 (contained in uranium enriched to 20 percent or more in the U-235 iso-tope).

(b) Unless otherwise approved by the Nuclear Regulatory Commission, no li-censee may make shipments of special nuclear material in which individual shipments are less than a formula quantity, but the total quantity in shipments in transit at the same time could equal or exceed a formula quan-tity, unless either of the following con-ditions are met:

(1) The licensee shall confirm and log the arrival at the final destination of each individual shipment and retain the log for three years from the date of the last entry in the log. The licensee shall also schedule shipments to ensure that the total quantity for two or more shipments in transit at the same time does not equal or exceed the formula quantity, or (2) Physical protection in accordance with the requirements of §§ 73.20, 73.25, and 73.26 is provided by the licensee for such shipments as appropriate so that the total quantity of special nuclear material in the remaining shipments not so protected, and in transit at the same time, does not equal or exceed a formula quantity.

[44 FR 68188, Nov. 28, 1979, as amended at 53 FR 19257, May 27, 1988]

PHYSICAL PROTECTION OF SPECIAL NUCLEAR MATERIAL IN TRANSIT

§ 73.25 Performance capabilities for physical protection of strategic spe-cial nuclear material in transit.

(a) To meet the general performance objective and requirements of § 73.20 an in-transit physical protection system shall include the performance capabili-ties described in paragraphs (b) through (d) of this section unless oth-erwise authorized by the Commission.

(b) Restrict access to and activity in the vicinity of transports and strategic special nuclear material. To achieve this capability the physical protection system shall:

(1) Minimize the vulnerability of the strategic special nuclear material by using the following subfunctions and procedures:

(i) Preplanning itineraries for the movement of strategic special nuclear material; (ii) Periodically updating knowledge of route conditions for the movement of strategic special nuclear material; (iii) Maintaining knowledge of the status and position of the strategic special nuclear material en route; and (iv) Determining and communicating alternative itineraries en route as con-ditions warrant.

(2) Detect and delay any unauthor-ized attempt to gain access or intro-duce unauthorized materials by stealth or force into the vicinity of transports and strategic special nuclear material using the following subsystems and subfunctions:

(i) Controlled access areas to isolate strategic special nuclear material and transports to assure that unauthorized persons shall not have direct access to, and unauthorized materials shall not be introduced into the vicinity of, the transports and strategic special nu-clear material, and (ii) Access detection subsystems and procedures to detect, assess and com-municate any unauthorized penetra-tion (or such attempts) of a controlled access area by persons, vehicles or ma-terials so that the response will satisfy the general performance objective and requirements of § 73.20(a).

(3) Detect attempts to gain unauthor-ized access or introduce unauthorized VerDate Sep<11>2014 13:23 Feb 22, 2018 Jkt 244031 PO 00000 Frm 00490 Fmt 8010 Sfmt 8010 Y:\\SGML\\244031.XXX 244031