ML19078A127

NEI White Paper - Security Bounding Time Revised Proposal (Public Document with Edit to Footnote 9 on 3-14-19)

ML19078A127
Person / Time
Site:	Nuclear Energy Institute
Issue date:	01/31/2019
From:	Nuclear Energy Institute
To:	Office of Nuclear Security and Incident Response
Cubellis L
References
Download: ML19078A127 (13)

Text

WHITE PAPER DETERMINATION OF A SITE-SPECIFIC SECURITY BOUNDING TIME January 2019

Determination of a Site-Specific Security Bounding Time 2 of 13 January 2019 This document was prepared by the Nuclear Energy Institute (NEI)1 and representatives of member companies.

NEI Security Working Group Sponsor: Rick Wesley - Dominion Energy Member Representatives:

Pat Asendorf - TVA Nuclear Chuck Coles - Arizona Public Service/STARS Alliance Danny Hicks - Dominion Energy Lisa Hogg - Southern Nuclear John Peacock - PSEG Nuclear Trina Washington - PSEG Nuclear Mike Whitlock - Dominion Energy NEI Lead: David Young Copyright Notice

© NEI 2019. All rights reserved. This material is protected by copyright law. It may not be copied, transmitted, stored, distributed, or excerpted, electronically or by other means, without NEIs advance written permission. This material may contain confidential information and is intended for distribution solely to NEI members, for their use. If you are not an NEI member, you may send a permission request to CopyrightAgent@nei.org. All copies must contain the NEI copyright notice and acknowledge that the use is with permission of NEI.

1 The Nuclear Energy Institute (NEI) is the organization responsible for establishing unified industry policy on matters affecting the nuclear energy industry, including the regulatory aspects of generic operational and technical issues. NEI's members include entities licensed to operate commercial nuclear power plants in the United States, nuclear plant designers, major architect/engineering firms, fuel cycle facilities, nuclear materials licensees, and other organizations and entities involved in the nuclear energy industry.

Determination of a Site-Specific Security Bounding Time 3 of 13 January 2019 Purpose and Overview This white paper describes a process that a licensee may follow to receive credit for law enforcement tactical support during an attack on a nuclear power plant through the determination of a Security Bounding Time (SBT).2 An SBT is the elapsed time, measured from recognition of an attack, required for a law enforcement tactical team to eliminate adversary interference sufficiently to allow performance of a mitigation action. Once credit is achieved, the licensee may consider the planned law enforcement tactical support (i.e., the SBT) in the development of target sets, including the potential addition of a mitigation action to a target set.

A mitigation action is any action taken by an operator to prevent radiological sabotage that does not meet the operator action criteria in Regulatory Guide 5.81, Target Set Identification and Development for Nuclear Power Reactors.3 Such actions may avert the loss of a target set or compensate for the loss of a target set. A mitigation action may include the use of equipment for mitigating the consequences of beyond-design-basis external events, or events leading to a loss of large areas of the plant due to explosions or fires, as required by NRC regulations, orders and licenses. For the purpose of this paper, any action that requires the elimination of adversary interference for performance is a mitigation action, even after the interference has been removed (i.e., an action performed after adversary interference has been precluded by law enforcement tactical support does not then become an operator action).

The SBT process is focused on developing a tactical plan to facilitate performance of a mitigation action; it is not intended to create an integrated response plan.

Licensees are currently required to liaise with law enforcement agencies and, to the extent practicable, document and maintain agreements to include estimated response times and capabilities. There are also requirements to describe available law enforcement assistance and initial response provisions in site Safeguards Contingency Plans. Compliance with these requirements notwithstanding, due to differences in protective strategies and law enforcement tactical response capabilities from site-to-site, the use of the SBT process by a licensee is voluntary.

Expected Benefits The SBT process will allow a licensee to include a mitigation action within a target set if the action can be performed after the SBT and prior to the irreversible onset of radiological 2 SBT was formerly referred to as Security Coping Time.

3 The operator action criterion of primary interest is Criterion #3. It is important to note that mitigation actions are different from the Damage Control Measures discussed in Regulatory Guide 5.81. The former is performed to prevent radiological sabotage while the latter may be taken after radiological sabotage has been achieved to minimize the significance of the potential adverse effects on public health and safety.

Determination of a Site-Specific Security Bounding Time 4 of 13 January 2019 sabotage, thus increasing the number of barriers to radiological sabotage. In addition, the law enforcement tactical response credited through the SBT process could be considered during the control and evaluation of tactical response drills and Force-on-Force (FOF) exercises, thus enhancing the realism of these activities (e.g., it may be assumed that a given adversary is neutralized after the site-specific SBT is exceeded). Establishing a SBT may also assist a licensee with crediting use of beyond-design-basis (BDB) event response strategies and equipment in controlling the damage caused by an attack (e.g., implementation of a FLEX strategy to mitigate the loss of a target set).4 Finally, the SBT process is expected to lead to enhanced planning and response coordination between a licensee and law enforcement agencies, including law enforcement tactical teams.

Relationship of SBT to a Physical Protection Program Required by 10 CFR 73.55 Following implementation of an SBT, a licensee will continue to maintain a physical protection program that complies with the requirements of 10 CFR 73.55, Requirements for physical protection of licensed activities in nuclear power reactors against radiological sabotage. More specifically, the licensee will retain the ability to defend against the Design Basis Threat (DBT) of radiological sabotage. Compliance with the requirements of §73.55 notwithstanding, the allowance to establish an SBT is grounded in the recognition that law enforcement tactical support will be available at some point during an attack to assist the licensee with threat containment and neutralization.5 By planning for this assistance, a licensee should be able to incorporate additional actions to prevent radiological sabotage into target sets, actions that are excluded from consideration as operator actions by the acceptance criteria in Regulatory Guide 5.81 (i.e., mitigation actions).6 Under the planning and response framework described in this document, the licensee will remain in control of the site physical protection program, including the onsite security force, during an attack. At the same time, the SBT process recognizes the reality that law enforcement tactical resources will be brought to bear during an actual event to support the licensee (i.e., a tactical team can aid the onsite security force with adversary neutralization or containment). To maximize the benefit of this support, the SBT process guides the development of a tactical response plan that addresses the coordination necessary between 4 To include within a target set, a licensee will need to document a basis for determining that the credited BDB event response equipment would be available (e.g., it is protected in a manner reasonably equivalent to plant equipment located within safety-related structures).

5 This point is consistent with direction in SRM-SECY-17-0100 that NRC policy concerning credit for a tactical law enforcement response should take into consideration the NRCs codified recognition of "the reality that in an actual emergency, state and local government officials will exercise their best efforts to protect the health and safety of the public" in 10 CFR 50.47(c)(1 )(iii)(B).

6 It is anticipated that this change would preclude threat scenarios extending well beyond typical times to core damage from the loss of primary target sets. These scenarios are not used during FOF exercise inspections but may be postulated during target set inspections or tabletop exercises. Credit for law enforcement support and mitigation actions would result in certain target sets no longer being desirable to an adversary.

Determination of a Site-Specific Security Bounding Time 5 of 13 January 2019 licensee and law enforcement agency personnel to affect implementation. The plan allows the licensee to credit law enforcement assistance specifically designed to enable the performance of actions that first require the elimination of adversary interference. These actions increase defense-in-depth by adding another layer of protection and further lowering the risk to public health and safety.

Relationship of SBT to Integrated Response The SBT process provides credit for tactical law enforcement capabilities during threat incidents bounded by the DBT. It is realistic to expect support from tactical law enforcement personnel at some point during an attack from an adversary force within the scope of the DBT, and licensee security plans should be able to credit this support with proper planning; however, it should also be recognized that the activities associated with implementation of the SBT process can provide a sound basis for an Integrated Response. As this term is used by the U.S.

Nuclear Regulatory Commission (NRC) within a security-related context, an Integrated Response means integrating tactical law enforcement capabilities with the site response to a beyond-DBT threat incident at a nuclear power plant.7 The planning and preparedness activities necessary to attain SBT credit for support during an attack bounded by the DBT would likewise facilitate a law enforcement tactical response during an attack by adversaries with beyond-DBT capabilities. Leveraging the hostile action-based (HAB) capabilities already described in a site emergency plan,8 a site that implements a SBT would be able to readily accommodate expanded law enforcement tactical support (i.e.,

beyond that described in a SBT tactical response plan) if such support became necessary. As an analogy, consider the NRC position that current Emergency Planning Zones (EPZs) provide a comprehensive emergency preparedness framework that would allow for expansion of the response efforts beyond the designated distances should an event warrant such an expansion (e.g., following a severe reactor accident). The ability to build upon a SBT tactical response plan to quickly transition into an Integrated Response is another expected benefit of the SBT process.

Finally, to provide a broader perspective, the table below shows the relationship of SBT to integrated response as well as related existing requirements contained in Title 10 of the Code of Federal Regulations (10 CFR) Parts 50 and 73.

7 Integrated Response is discussed in several NRC documents; a good overview is presented in COMSECY-13-0005, Integrated Law Enforcement Response at Nuclear Power Plants, dated February 7, 2013.

8 Capabilities as required by 10 CFR 50, Appendix E, Emergency Planning and Preparedness for Production and Utilization Facilities.

Determination of a Site-Specific Security Bounding Time 6 of 13 January 2019 Site and Law Enforcement Agency Coordination Tactical Responses DBT 10 CFR 73.55, and Appendices B & C 10 CFR 50, Appendix E

[Letters of Agreement and Hostile Action-Based Exercises]

10 CFR 73.55, and Appendices B & C

[FOF Exercises]

Security Bounding Time Beyond-DBT 10 CFR 50, Appendix E

[Letters of Agreement and Hostile Action-Based Exercises]

Transition to an Integrated Response SBT Process The SBT process steps are presented below.

Step #1 - Identify the Mitigation Action: The licensee identifies a mitigation action that would require the support of a law enforcement tactical team to implement. The support would entail protection against, or elimination of, adversary interference so as to allow performance of the action. The selected action should serve as the planning basis for completing the remaining steps listed below.

Step #2 - Planning and Procedure Development: In conjunction with law enforcement agency personnel, develop a tactical response plan and supporting procedures for briefing and deploying a tactical team during an attack on the site.9 Tactical team members are responsible for determining the mission parameters and means best suited to enable performance of the mitigation action (e.g., perimeter establishment and control, area sweeps and searches, retaking a room, protective escorting, etc.). Planning for the teams anticipated actions should be informed by site-specific mission needs (e.g., a breaching capability for a specific barrier or door). Consideration should also be given to building upon the capabilities in place to meet the hostile action planning and response requirements of 10 CFR 50, Appendix E, as described in the site emergency plan.10 The following elements should be addressed:

1.

A staging area.

2.

A briefing area with mission planning tools and materials (e.g., Contingency Response 9 The development of the plan and procedures should leverage the information and resources already available from a site-specific Contingency Response Tool and Integrated Response Plan. Sites without a Contingency Response Tool should consider the guidance in Attachment 1, Tactical Team Mission Planning Considerations (not publicly available).

10 To identify and maximize potential synergies, an individual from the emergency preparedness department should be included in the planning and procedure development phase.

Determination of a Site-Specific Security Bounding Time 7 of 13 January 2019 Tool and hard-copy planning documents).

3.

Provisions for allowing licensee personnel to travel to and access the staging and briefing areas (e.g., arrangements to allow passage through offsite traffic control points and law enforcement checkpoints).

4.

Methods for licensee personnel at the briefing area to communicate with the Control Room and alarm stations to understand site conditions and priorities.

5.

Roles and responsibilities for conducting a mission briefing, and topics to be covered.

6.

The assignment and use of security officers or other site personnel as escorts/embeds, as requested.

7.

Use of communications systems and protocols that consider potential site-specific impediments (e.g., signal attenuation within the plant, jamming by adversaries, high ambient noise levels, etc.).

8.

Equipment and protocols to prevent fratricide by the onsite security force (e.g.,

provide an Identification Friend or Foe [IFF] capability) and provide mission updates.

9.

As applicable to the planned mitigation action, steps to expedite access to the site, Protected Area and Vital Areas, including actions to address potential impediments (e.g., a vehicle barrier is in the deny access position).

10. Consideration of industrial and radiological safety hazards, including availability of dosimetry and other radiation protection equipment and supplies.

11. Communications and coordination with the site Emergency Response Organization (e.g., responders at an Alternative Facility or Emergency Operations Facility).

12. Pre-staging of site documents, equipment and supplies needed by the tactical team (e.g., create a go-bag). A plan for delivery of these items at the time of the event should be carefully evaluated to ensure that implementation is feasible under anticipated attack conditions.

The development of a tactical response plan and supporting procedures should consider the need for the following resources:

1.

An armored vehicle.

2.

Breaching equipment.

3.

Ballistic shield/armor.

4.

Night vision equipment, to include consideration of infrared light sources.

5.

Aviation support, manned or unmanned (drone), for surveillance and intelligence collection.

6.

Personal Protective Equipment (PPE) to enable tactical operations in an area contaminated with a hazardous material (e.g., responders are familiar with applicable PPE standards and practices established by their State or agency).

7.

Supporting resources for perimeter control and containment, and a medical response.

NEI maintains operating experience and lessons learned documents that would be helpful to creating an effective tactical response plan and supporting procedures. Security personnel are

Determination of a Site-Specific Security Bounding Time 8 of 13 January 2019 encouraged to request these documents from NEI and consider them during development of site-specific plan and procedures.

Step #3 - Determine Required Tactical Team Composition and Capabilities: As informed by the tactical response plan and procedures developed in Step #2, the law enforcement agency should determine the composition and capabilities of the tactical team needed to have reasonable assurance of completing the assigned mission. Reflecting operating experience and lessons learned, the recommended minimum team composition and capabilities are presented below, and bifurcated dependent upon the mission location.

1.

If the tactical team mission will take place outside the Protected Area, then the team should meet the Capabilities and Personnel attributes for a Tier 2 Special Weapons and Tactics Team (SWAT) as described in Tactical Response and Operations Standard for Law Enforcement Agencies, published by the National Tactical Officers Association (NTOA),11 dated April 2018.12 For example, the team is expected to engage and neutralize an adversary in a location outside the Protected Area.

2.

If the tactical team mission will take place inside the Protected Area, including structures such as the power block, then the team should meet the Capabilities and Personnel attributes for a Tier 1 SWAT as described in Tactical Response and Operations Standard for Law Enforcement Agencies. For example, the team will enter the power block to facilitate movement of an operator from one location to another.

A team meeting either of the above NTOA standards would be mission capable in the following areas:

• Barricaded gunman

• Sniper operations

• High-risk warrant service and high-risk apprehension

• High-risk security operations

• Terrorism response The tactical team may be supplied by the law enforcement agency with jurisdictional authority over the site or made available through a mutual aid/support agreement with another law 11 As stated on their website, the NTOA is a U.S.-based non-profit organization serving the law enforcement community with a mission to enhance the performance and professional status of law enforcement personnel by providing a credible and proven training resource as well as a forum for the development of tactics and information exchange. Their membership includes State and local law enforcement agencies from across the U.S.

12 This document was selected as a standard because it is prepared by knowledgeable law enforcement professionals, including representatives from Federal agencies. As an open source document, it will facilitate planning coordination and communications among participants, and support comparisons with other standards that may reference or be similar to it (e.g., a regional standard).

Determination of a Site-Specific Security Bounding Time 9 of 13 January 2019 enforcement agency or a regional association. A State agency tactical team (e.g., from the State Police) may also be used. In cases where a team is explicitly chartered to meet a State or Federal tactical capabilities standard, credit may be extended if the basis standard is reasonably equivalent to the NTOA standard (i.e., the State or Federal standard ensures mission capabilities in the areas listed above).

The required tactical team composition determined by the law enforcement agency for the site-specific mission may be greater or less than the recommended minimums above. In the latter case, the licensee should document why the law enforcement agency determined that the deviation is acceptable (e.g., the aspects of the site-specific mission that provide justification for less than the recommended minimum team staffing). The final team composition should be described in the tactical response plan.

Step #4 - Verify and Validate the Tactical Response Plan and Procedures: The licensee should verify and validate (V&V) the tactical response plan and supporting procedure content. This step is accomplished by conducting a tabletop drill and a practice drill with appropriate law enforcement officials and tactical team officers. Following completion of each activity, the tactical response plan and procedures should be revised to incorporate lessons learned.

The planning for the tabletop drill should consider the guidance in NEI 13-03, Conduct of an Integrated Response Plan Table Tops and Limited Exercise, and NEI 06-04, Conducting a Hostile Action-Based Emergency Response Drill. The practice drill should have the following attributes.

• The drill should be treated as a supervised instruction period aimed at developing skills needed for effective mission performance (e.g., no win-lose evaluation).

• The drill should be conducted at a walk-through pace to promote plant and equipment familiarity, and identify and reinforce learning opportunities.

• The scenario should drive performance of both a mission briefing and the mission execution.

• Participants should include representatives from site departments that would be interfacing with the tactical team in a real event (e.g., from Security and Operations).

• Once initial familiarity is gained with mission-related areas, controllers should play the role of armed adversaries using established security drill equipment and techniques (e.g., use of a multiple integrated laser engagement system or red guns, resurrection of neutralized team members to continue participation and learning) and create conditions that require the team to perform tactical maneuvering and engagement actions, albeit at a walk-through pace.

• Drill performance should be critiqued and deficiencies entered into a corrective action process.

Determination of a Site-Specific Security Bounding Time 10 of 13 January 2019 Step #5 - Determine Training and Drill Requirements: The licensee and law enforcement personnel should determine and document the types and frequencies of training and drills that will be conducted to instill and maintain response proficiency. The following guidance should be considered:

1. The licensee may align tactical team training and drills with other law enforcement training and drill activities already performed to meet the requirements of their site-specific security plan.

2. The licensee should explore opportunities for the tactical team to obtain credit for participation in site training and drills as a means to satisfy a State or Federal requirement. This approach may provide an external funding source for an activity.

3. NEI maintains operating experience and lessons learned documents that would be helpful to creating effective training materials; training developers are encouraged to request these documents from NEI and consider them during development of site-specific training briefings and lesson plans.

4. Training sessions should include tours to familiarize tactical team personnel with the areas in which they would be maneuvering and conducting operations (i.e., areas addressed in the tactical response plan).

5. Periodic practice drills should be conducted using the guidance presented in Step #4.

The licensee should also offer the NRC an opportunity to observe a practice drill once every three calendar years; this offer should be made through contact with the Resident Inspectors office and no later than 90 days prior to the drill. There are several options for conducting an NRC-observed drill - it may be included within the scope of a site tactical response drill, an FOF exercise,13 an emergency preparedness hostile action-based (HAB) drill, or conducted as a stand-alone activity.

6. There should be provisions to conduct ad hoc training and drills as needed to address turnover of tactical team personnel. The goal is to always maintain a sufficient number of individuals with the requisite training and drill experience to provide reasonable assurance of successful mission execution.

Step #6 - Prepare SBT Process Documentation: The following documentation and records should be retained for inspection.

1. The tactical response plan and supporting procedures.

2. A Letter of Agreement (LOA) / Memorandum of Understanding (MOU) between the licensee and law enforcement agency that addresses the following:

a. Acknowledgment that tactical law enforcement capabilities may be necessary to allow the plant staff to perform a time-critical action for preventing radiological sabotage (i.e., provide tactical support for an action to correct or mitigate conditions 13 An exercise performed in accordance with NRC Inspection Procedure (IP) 71130.03, Contingency Response -

Force-on-Force Testing, or IP 71130.05, Protective Strategy Evaluation and Performance Evaluation Program.

Determination of a Site-Specific Security Bounding Time 11 of 13 January 2019 posing a threat to public health and safety).

b. The law enforcement agency will provide tactical response capabilities necessary to implement the mutually agreed upon tactical response plan. The LOA / MOU should identify if these capabilities are supplied directly by the agency or through a mutual aid/support agreement with another law enforcement agency.

c. The normally expected response time needed for tactical team personnel to arrive at the designated staging area, referenced from the start time of the initial notification of the law enforcement agency. This time should be rounded to the nearest hour or half-hour (e.g., 30 minutes, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, etc.).

d. A summary of the support and assistance that will be provided by Security and personnel from other site departments (e.g., Operations) to facilitate briefing and deployment of the tactical team.

e. Designated site contacts to communicate with the tactical team (e.g., Shift Manager and Central Alarm Station Operator).

f. A summary description of the training and drills provided by the licensee to the tactical team, and associated frequencies.

g. A summary of responsibilities for maintenance of equipment and resources.

h. Verification of the LOA / MOU on an annual basis, and timely notification to the licensee of any material changes to tactical team staffing, capabilities or response times.

The above topics may be added to an existing LOA / MOU or the subject of a new LOA /

MOU, or a combination of the two.

3. As permitted by Step #2, the basis for deviating from the applicable NTOA SWAT standard, either in team composition or a capability, or both (e.g., what aspects of the site-specific mission provide justification for less team staffing or capability).

4. Training program materials (e.g., lesson plans, briefing agendas, etc.).

5. Records of offered training and drills, and attendance.

6. Drill reports and related corrective action program records.

7. Steps to be taken by the licensee if becoming aware an anticipated or actual change to tactical team staffing or capabilities that may impact the teams response time or ability to implement the planned mission. Upon being notified of such a change, the licensee should:

a)

Discuss the change with the cognizant law enforcement agency and identify potential impacts.

b) Determine if the expected tactical support remains viable within the scope of the tactical response plan (i.e., the mission can be completed after the change).

c)

If the expected tactical support remains viable, then communicate the change and update documents as necessary.

d) If the expected tactical support is no longer viable, then make prompt adjustments to the physical security program and site protective strategy as

Determination of a Site-Specific Security Bounding Time 12 of 13 January 2019 required to reflect the loss of the SBT.

Determination of Security Bounding Time The licensee should determine the site-specific SBT, which is the sum of four components:

1. Notification Time: [Redacted]; this is the assumed elapsed time from recognition of an attack by the site security force to initial notification of a law enforcement agency.

2. Team Response Time: The elapsed time from initial notification of the law enforcement agency to the arrival of the tactical team at the designated staging area as documented in an LOA / MOU.

3. Mission Planning Time: The elapsed time from the arrival of the tactical team at the designated staging area to their arrival at the site, including receipt of a mission briefing and completion of other preparations for deployment.

a. For missions outside the Protected Area, the assumed time is [redacted], OR

b. For missions inside the Protected Area, including structures such as the power block, the assumed time is [redacted], OR

c. A mission planning time may be determined by the tactical team agency that is not less than the applicable time in a or b, above.

4. Mission Execution Time: The assumed elapsed time from tactical team arrival at the site to mission completion (e.g., protecting movement of an operator, or neutralization or containment of an adversary force member).

a. For missions outside the Protected Area, the assumed time is [redacted], OR

b. For missions inside the Protected Area, including structures such as the power block, the assumed time is [redacted], OR

c. An execution time may be determined by the tactical team agency that is not less than the applicable time in a or b, above.

An elapsed time sum that does not coincide with a whole or half-hour, should be rounded up to the next 30-minute time increment (e.g. a sum of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and 15 minutes should be rounded up to an SBT of 4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).

The assumed mission planning and execution times above are considered reasonable and bounding for a wide range of conditions. Using drills to determine these times is impractical given the number of variables and uncertainties associated with an actual attack (i.e., a very large number of scenarios are possible), and the inability to run all aspects of a drill at a real world pace (due to personal, industrial and radiological safety requirements). The availability

Determination of a Site-Specific Security Bounding Time 13 of 13 January 2019 of assumed times notwithstanding, the tactical team agency may determine times greater than the assumed times based on the application of professional judgement and experience to the planned mission profile and tasks. The licensee should confirm the times used to calculate the SBT with the tactical team agency prior to implementation.

The SBT, and the determination of each component, should be described in a controlled security program document.