ML19296C151
| ML19296C151 | |
| Person / Time | |
|---|---|
| Issue date: | 12/21/1979 |
| From: | Minogue R NRC OFFICE OF STANDARDS DEVELOPMENT |
| To: | |
| Shared Package | |
| ML19296C119 | List: |
| References | |
| REF-10CFR9.7 SECY-79-682, NUDOCS 8002250286 | |
| Download: ML19296C151 (16) | |
Text
.
f s
UNITED STATES Cecember 21, 1979 NUCLEAR REGULATORY COMMISSION SECY-79-682 WASHIN GTON, D. C. 20sss CONSENT CALENDAR ITEM For:
The Commissioners From:
Robert B. Minogue, Director Office of Standards Development Thru:
Executive Director for Operations E [o s '-
Subject:
ACCEST CONTROLS TO NUCLEAR POWER PLANT VITAL AREAS
Purpose:
To obtain Cammission approval for a notice of a proposed rule change which w(...a more explicitly define the criteria for access controls required at entrances to nuclear power plant vital areas.
Cateaory:
This paper covers a minor policy question requiring Commission approval Discussion A recent survey at the Surry nuclear reactor station, initiated because of a successful attempt to damage fuel at the facility, determined that several hundred licensee and contractor personnel had access to the area where the fuel was stored (a vital area) during the time the attempt was made.
Many of the personnel did not raquire access to this vital area during the time the incident occurred and many did not need access to this vital area at all.
Surveys at other nuclear power reactors revealed that similar conditions existed.
That is, access to vital areas was authorized on a basis which generally was tied to an individual's title, i.e., nuclear engineer, without estab-lishment of the need for an individual to be in an area at all nor to be in an area during a particular time frame.
Also, " tailgating" (more than one person passing through a control point on only one person's authorized access) was taking place at the facilities.
Current regulations and associated guidance documents containing criteria dealing with access controls to vital areas are discussed in Enclosure B.
In approving the physical security plans submitted to fulfill 10 CFR 73.55, NRC has delegated to the licensee the respon-sibility for determining which individuals may have access to vital areas within the context of the regulations and guidelines listed in Enclosure B.
The recent surveys of all operating nuclear power reac-tors revealed that some of the licensees have broadly interpreted the guidelines and have used lax criteria for authorizing individuals unescorted access to vital areas.
That is, access lists to particular vital areas included anyone who might need unescorted access to that area regardless of the frequency or duration of the need.
This was not the intent of the regulations or guidelines.
In order to define more clearly the criteria for access controls to vital areas and to put them into regulatory requirements, it is pro-posed to revise 10 CFR 73.55(d)(7) along the following lines:
Contact:
T. Michaels 443-5903 26
The Commissioners 2
(1) Access to a vital area shall be correlated to the need to have access to that area, and shall be limited to a particular time period for which access is needed.
(2) Licensee procedures and/or equipment shall be made available to assure that only the authorized individual can gain unescorted entry to a vital area on his/her authorization.
The regulatory requirements being proposed are essentially those that the staff intended licensees to implement through present regulations and existing guidance.
The present regulations, however, are not suffi-ciently specific as to their intent; the proposed regulation would pro-vide the needed degree of specificity.
The requirements.being pro-posed already are contained in an Inspection and Enforcement Bulletin, IE Bulletin No. 79-16, " Vital Area Access Controls" issued July 26, 1979 (Enclosure C).
This bulletin was issued to advise licensees that these changes to vital area access controls were needed in light of the Surry incident.
One criterion in IE Bulletin No. 79-16 not included in the requirements, is that having to do with trustworth-
- iness, i.e., a screening program meeting American National Standards Institute (ANSI) Standard, ANSI 18.17, Industrial Security for Nuclear Power Plants.
The reason this criterion is not included in these requirements is that, to prescribe a licensee administered trustworth-iness program by rule at this time, when the Commission has under con-sideration both a proposed material access authorization rule and alternative programs for establishing trustworthiness at nuclear power plants, would be inappropriate.
10 CFR 73.55(g) is also being amended to include access control equip-ment and all other security-related devices or equipment under the testing and maintenance requirement.
It is expected that the changes resulting from the amendments would, for the most part, be procedural, e.g.,
keeping of access lists, which the licensee can implement without a major modification of the security or contigency plan.
However, plans would need some revisions to address the new requirements.
These revisions would be handled as changes that "do not decrease the safeguards effectiveness of the plan" and, in accordance with 10 CFR 50.54(p), shall be submitted to the NRC within 2 months after the revisions are made.
These actions involve no new resource requirements.
Recommendation:
That the Commission:
1.
Aoprove the proposed amendments set forth in Enclosure "A" for publication for comment in the Federal Register.
2.
Note that the public will be given 60 days in which to comment on the proposed changes.
The Commissioners 3
3.
Note that the value/ impact analysis (Enclosure "D") will be placed in the Public Document Room.
4.
Note that the appropriate congressional committees will be notified of this action.
5.
Note that a public announcement of this action will not be issued.
6.
Note that neither an environmental impact statement nor a nega-tive declaration need be prepared since the proposed amendments are not significant from the standpoint of environmental impact.
Coordination:
The Offices of Nuclear Reactor Regulation, Inspection and Enforcement, and Nuclear Material Safety and Safeguards concur in the recommenda-tions of this paper.
The Office of the Executive Legal Director has no legal objection to the recommendations of this paper.
The Office of Public Affairs indicates that a public announcement is not warranted.
Scheduling:
For affirmation at an early policy session.
Sunshine Act Recommendation:
It is recommended that this par r be considered in an open meeting.
The Executive Director for 0p ations urs in this recommendation.
f 9
Jer'\\ B. F o@e, D rector
\\
Officel of Standards Development i
Enclosures:
"A" - Proposed Federal Register Notice "B" - Criteria Dealing with Access Controls to Vital Areas "C" - IE Bulletin 79-16 "D" - Value/ Impact Analysis
4 Commissioners' comments or consent should be provided directly to the Office of the Secretary by c.o.b. Friday, January 11, 1980.
Commission Staff Office comments, if any, should be submitted to the Commissioners NLT January 4,1980, with an information copy to the Office of the Secretary.
If the paper is of such a nature that it requires additional time for analytical review and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected.
This paper is tentatively scheduled for affirmation at an Open Meeting during ti.e Week of January 21, 1980.
Please refer to the appropriate Weekly Commission Schedule, w'.en published, for a specific date and time.
DISTRIBUTION Commissioners Commission Staff Offices Exec Dir for Operations ACRS Secretariat
8 9
/
s ', 6 s
\\\\
.'. s. s..
s yg s-j s ', gV-s
, v -'
5 s,'\\#
y
(
,.s \\, 6
\\'.
g' s
g,3 ' '
~
.\\ 's \\,.
.\\',
s sv'j. s,3
(
\\ 'g b
ENCLOSURE A
NUCLEAR REGULATORY COMMISSION
[10 CFR Part 73]
Physical Protection of Plants and Materials Access Controls to Nuclear Power Plant Vital Areas AGENCY:
U.S. Nuclear Regulatory Commission ACTION:
Proposed rule
SUMMARY
The Commission is considering amendments to its regulations to define more explicitly the criteria for personnel access controls for nuclear power plant vital areas.
The controls would be, for the most part, procedural in scope and would require that (1) access authorization to a vital area be correlated to the need to have access to that area during a particular time period, and (2) licensee procedures and/or equipment be used to assure that only the authorized individual can gain unescorted entry to a vital area on his/her authorization.
The require-ments being proposed are contained in Inspection and Enforcement Bulletin No. 79-16, " Vital Area Access Controls" July 26, 1979.
DATES:
Comments must be received on or before (60 days after publica-tion in the Federal Register).
ADDRESSEES:
Comments or suggestions for consideration in connection with the proposed amendments should be sent to the Secretary of the Commission, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, Attention:
Docketing and Service Branch.
Copies of comments received may be examined at the Commission's Public Document Room at 1717 H Street, NW., Washington, D.C.
1 Enclosure "A"
FOR FURTHER INFORMATION CONTACT:
T. S. Michaels, Safeguards Standards Branch, Office of Standards Development, U.S. Nuclear Regulatory Commis-sion, Washington, D.C. 20555, 301-443-5903.
SUPPLEMENTARY INFORMATION:
The requirements for access controls at vital areas of nuclear power plants are in section 73.55(d)(7) of 10 CFR Part 73.
Supplementary guidance in this area has been developed and made available to licensees.
This includes Acceptance Criterion 5.B of the Security Plan Evaluation Report (SPER) Workbook, Office of Nuclear Reactor Regula-tion (NRR) Review Guideline #21, and NRR Review Guideline #23.
- Also, NRR, in meetings with licensees in March 1977, to explain section 73.55 and provide information on what an acceptable security plan should con-tain, explained that positive control of access to a vital area consisted of two elements:
first, in order to be authorized access to a particular vital area, the person requesting entry must have had the necessary back-ground screening and have an established need to perform job related functions in the area, and second, that there be a need to enter the vital area to perform a specific function at a specific time.
In the past, the determination of which individuals have had access to particular vital areas has been left up to the licensee to implement within the context of the regulation and guidelines mentioned previously.
Recent surveys of all operating nuclear power reactors have revealed that some licensees have broadly interpreted these guidelines and have used lax criteria for authorizing individuals unescorted access to vital areas.
That is, access lists to particular vital areas have included anyone who might need unescorted access to that area regardless of the frequency or duration of the need.
This was not the intent of the regulations or guidelines.
2 Enclosure "A"
In order to define more clearly the criteria for vital area access controls and to put them into the codified regulations it is proposed to revise section 73.55(d)(7) and other applicable sections along the follow-ing general guidelines:
(1) Access to a vital area will be correlated to the need to have access to that area, and also will be limited to the particular time period that access is needed.
(2) Licensee procedures and/or equipment shall be made available to assure that only the author-ized individual can gain unescorted entry to a vital area on his/her key, key card, or other entry mechanism.
The amendments being proposed are essentially those that the Commis-sion intended licensees to implement through present regulations and existing guidance.
The present regulations, however, are not sufficiently specific as to their intent.
The proposed regulation would provide the needed degree of specificity.
The criteria being proposed are contained in a Nuclear Regulatory Commission Inspection and Enforcement Bulletin, IE Bulletin No. 79-16,
" Vital Area Access Control" issued July 26, 1979.
One criterion in IE Bulletin No. 79-16 not included in the requirements is that having to do with trustworthiness, i.e., a screening program meeting American National Standards Institute (ANSI) Standard, ANSI 18.17, Industrial Security for Nuclear Power Plants.
The reason this criterion is not included in these requirements is that, to prescribe a licensee administered trustworthiness program by rule at this time, when the Ccmmission has under consideration both a proposed material access authorization rule and alternative programs 3
Enclosure "A"
for establishing trustworthiness at nuclear power plants, would be inappropriate.
10 CFR 73.55(g) is also being amended to include access control equipment and all other security-related devices or equipment under the testing and maintenance requirement.
It is expected that the changes resulting from the amendments would be procedural, e.g., keeping of access lists which the licensee can imple-ment without a major modification of the security or contingency plan.
However, plans would need some revising to include the new requirements.
These revisions would be handled as changes that "do not decrease the safe-guards effectiveness of the plan" and, in accordance with 10 CFR 50.54(p) shall be submitted to the NRC within 2 months after the revisions are made.
The amendments, if approved, would become effective 75 days after publication in the Federal Register.
The promulgation of the amendment would not result in any activity that affects the environment.
Accordingly, the Commission has determined under the National Environmental Policy Act, the Council of Environmental Quality guidelines, and the criteria of 10 CFR Part 51.5(d)(3), that neither an environmental impact statement or environmental impact appraisal to support a negative declaration for the proposed amendments to 10 CFR Part 73 is required.
Pursuant to the Atomic Energy Act of 1954, as amended, the Energy Reorganization Act of 1974, as amended, and Section 553 of title 5 of the United States Code, notice is hereby given that a<ioption of the following amendments to Title 10, Chapter I, Code of Federal Regulations, Part 73 is contemplated.
4 Enclosure "A"
PART 73 - PHYSICAL PROTECTION OF PLANTS AND MATERIALS 1.
Section 73.55(d)(7) of 10 CFR Part 73 is amended to read as follows:
$73.55 Requirements for physical protection of licensed activities in nuclear power reactors against industrial sabotage.
(d)(7)
The licensee shall positively control all points of per-sonnel and vehicle access into vital areas.
Access to vital areas shall be limited to individuals with access authorization who are-authorized access-to-vitai-equipment-and-who-require-such-access-to perform-their duties have a need to enter the vital area based upon assigned duties requiring the performance of tasks in the vital area.
Authorization-for such-individeais-shafi-be provided-by-the-issuance-of-specially-ceded numbered-badges-indicating-vitai-areas-to-which-access-is-aetherized:
Access-to-vitai-areas-for-the perpose-of generai-famiiisrization-and-ether non-work-reisted-activities-shali-not-be-setherized-except-for good-cause shown-to-the-ficensee-Unoccupied vital areas shall be locked and protected by an active intrusion alarm system.
Access shall be based uoon the following:
(i) Access lists shall be established and approved for each vital area by the onsite individual responsible for security (or equivalent) or his designated representative.
Acoroved access duration and areas shall be commensurate with the tasks to be cerformed.
To remove individuals who no loncer have a need for access, access lists shall be reviewed, 5
Enclosure "A"
updated and reapproved at the end of each access duration period not to exceed 31 days.
(ii) Each individual granted access to vital areas shall be issued a serially numbered badge tnat displays a visible code indicating the level of unescorted access granted and corresponding to vital area designations in the secur-ity plan.
(iii) Emergency access lists shall be established and approved for each vital area by the onsite individual responsible for security (or equivalent) or his designated reoresenta-tiva.
Access controls and written procedures to cope with emergency conditions shall be established.
(iv)
Licensee procedures and/or eauipment shall be established to assure that only the authorized individual can gain unescorted entry to a vital area on his/her key, key card, or other entry mechanism.
2.
Section 73.55(g) of 10 CFR Part 73 is amended to read as follows:
(g) Testing and maintenance.
Each licensee shall test and maintain intrusion alarms, emergency alarms, access control eauipment, communica-tions equipment, physical barriers, and all other security-related devices or equipment utilized pursuant to this section, as follows:
x s
n 6
Enclosure "A"
[ Sections 161i, 1610, Public Law 83-703, 68 Stat. 949, 950, as amended, Pub. Law 85-507, 72 Stat 327, Pub. L.93-377, 88 Stat. 475 (42 U.S.C.
2101); Sec. 201, Pub. Law 93-438, 88 Stat. 1242-1243 (42 U.S.C. 5841)]
Dated at Washington, D.C.,
this day of 1979.
For the Nuclear Regulatory Commission.
Samue1 J. Chi 1k Secretary of the Commission 7
Enclosure "A"
A,,til%
-, ?
(
9.,
.I -
ss E' '
ENCLOSURE B a
CRITERIA DEALING WITH ACCESS CONTROLS TO VITAL AREAS 10 CFR 73.55(a) requires licensees to protect against industrial sabotage by an insider, including an employee (in any position).
10 CFR 73.55(d)(7) states that access to Vital Areas shall be positively controlled and limited to individuals who are authorized access to vital equipment and who require such access to perform their duties.
Specific commitments implementing this regulation are described in each licensee's approved Security Plan.
NRR, in meetings with licensees in March 1977, to discuss $73.55 and the components of an acceptable physical security plan, explained that positive control of access to vital areas consisted of two elements:
one, to be author-ized access to a Vital Area, the individual requesting entry must have the necessary background screening and a need to perform job related functions in the area, and two, to have a need at that specific time to enter the Vital Area to perform a specific function.
This is comparable to gaining access to a classified document; one must have both a clearance and a need-to-know.
In approving security plans, NRR has assumed that the determination of need would be based upon a valid need and not convenience.
Furthermore, access should be authorized to a minimum number of people, and licensees should use a reasonable basis to determine this restricted number of authorized personnel and the frequency of their access.
Acceptance Criterion 5.B of the Security Plan Evaluation Report (SPER)
Workbook, dated January 1978, states that the licensee must commit to providing positive access control to Vital Areas by:
1)
Limiting access only to authorized personnel.
2)
Requiring positive identification prior to entry.
1 Enclosure "B"
3)
Requiring an established need for access.
4)
Maintaining records of entry, exit, and reason for entry.
5)
Providing a system for personnel control within the Vital Area.
NRR Review Guideline #21 suggests that blanket access authorizations should not be granted.
Instead, an acceptable method of indicating Vital Areas to which access is authorized should include a record of each vital area to which the holder of a key card is authorized access, and the key card be encoded to permit access only to those Vital Areas to which an individual has been granted access.
Review Guideline #23 states that for access to a Type I Vital Area, the person must be authorized entry by the shift supervisor or other designated individual who has been informed of the estimated length of time to be spent in the Type I Vital Areas.
2 Enclosure "B"
1 aD
_3. n..., \\
-np :cq
, 9 '... s,
-\\p; gula
,./
- c. h t\\Q]lG'b i
sc..
'L,-
^^
,t'.
,.{C, :; u J
ENCLOSURE C
Enclosure "C" UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE 0F INSPECTION AND ENFORCEMENT WASHINGTON, D.C.
20555 July 26, 1979 IE Bulletin No. 79-16 VITAL AREA ACCESS CONTROLS
[
Oescription of Circumstancest An attempt to damage new fuel assemblies occurred recently at an operating nuclear reactor facility.
During a routine fuel inspecticn, the licensee discovered that a chemical liquid had been poured over 62 of 64 new fuel assemblies.
Analysis indicates that the chemical liquid was sodium hydroxide, a chemical stored and used onsite.
The licensee stores new fuel assemblies in dry storage wells on the same elevation as the spent fuel pogl within the Fuel Building, a vital area.
Access to the building is controlled by use of a coded Leycard which elec-tronically unlocks the alarmed personnel portals.
The licensee issues coded keycards to both licensee and contractor personnel after the successful ccm-pletion of a background screening program.
In addition, licensee site manage-ment certifies monthly that each individual has the need for a coded keycard in order to perform required duties.
Further access within this building is not limited by other barriers or controls.
As a result of this incident, an initial licensee audit determined that several hundred licensee and contractor persennel had access to this area during the period when the attempt to damage the fuel was made.
The audit also revealed that one coded keycard reader at a vital area portal was inaccurately recording access data at the alann station.
Also discovered during this audit were indications of frequent " tailgating" on access through the portals.
Tailgating occurs when more than one person passes through a portal on one persen's authorized access.
Their passage is therefore not recorded, and unauthorized persons could gain entry in this manner.
Tailgating does not include author-ized access controlled by an escort.
Discussion of Applicable Requirements:
10 CFR 73.55(a) requires the licensees to protect against industrial sabotage cc:nnitted by an insider in any position.
10 CFR 73.55(d)(7) states that access to Vital Areas shall be positively controlled and limited to individuals who are authorized access to vital equipment and who i equire such access to perform their duties.
Specific ccmmitments implementing this regulation are described in each licensee's approved Security plan.
dute
,j Ti 07 0 M 0
IE Bulletin No. 79-15 July 26,1979 Page 2 of 4 NRR, in their meetings with the licensees in March 1977 to explain 5 73.55 and what would constitute an acceptable plan, explained that positive control of access to a vital area consisted of two elements:
first, chat the persen requesting. entry has the necessary background screening and need to perform job related functions to be authorized access to that Vital Area, and second, that he has a need at that specific time to enter to perform a specific func-tion.
This is camcarable to gaining acc.sss to a classified document; you need both a clearance and a need to know.
In approving security plans, NRR assumes that the determination of need would be based upon a valid need and not convenience.
Furthermore, access should be authorized to a minimum number of people, and licensees should use reason-abis alternatives to minimize the number of personnel and frequency of access.
Acceptance Criterion.5.S of-the Security Plan Evaluation Report (SPER)
Workbook, dated January 1978, states that the licensee must ccanit to pro-viding positive access control to Vital Areas by:
1)
Limiting access to authorized personnel.
2)
Requiring positive identification prior to entry.
3)
Requiring an established need for access.
4)
Maintaining records of entry, exit and reason for entry.
5)
A system for control within the Vital Area.
NRR Review Guideline #21 suggests that blanket access authorizations should not be granted by stating that an acceptable methcd of indicating the Vital Areas to which access is authorized includes a record of each vital area to which the holder is authorized access, and the card is encoded to permit access to only those Vital.oreas to which the individual has been granted access.
Review Guideline #23 states that for access to a Type I Vital Area, the person must be authorized entry by the shift supervisor or othar designated individual who has been informed of the estimated length of time to be spent in the Type I Vital Area.
There needs to be scme balance attained between operational necessity and the administrative burden of validating the need for access each time entry is tn be afforded.
Many licensees grant " permanent access authorization" to all 7
persons requiring access to vital areas, regardless of the frequency or dura-tion of the need.
This is contrary to the regulations and guidelines frcm NRR cited above.
Enc 1asure "C" O
IE Bulletin No. 79 16' July 25,1979 page 3 of 4 Action to be Taken by' Licensee:
1.
Establish ci-iteria for granting unescorted access to each vital area, which shall be based umn the following:
a.
A screening program meeting ANSI N18.17.
i b.
The individual has a valid need for access to the equipment contained in each vital area to which access is authorized.
Valid need is based upon assigned duties requiring the performance of specific tasks upon or associated with specific equipment located in each vital area to which access is granted.
Valid need to enter one vital area shall not necessarily indicate that the person has a need to enter any other vital area.
2.
An access list will be established for each arc.a rot to exceed 31 days.
An individual will' be on the access list only for the duration of the task to be p'rformed.
If an individual has a valid need for unescorted e
access for a single entry or for intermittent occasions during this period, a separate daily access list shall be prepared.
All access lists shall be approved by the station manager (or equivalent) or his designated representative.
3.
Individuals will be. removed from the access list imediately upon termination of need.
If an individual has not entered the vital area during the effective period of the access list (not to exceed 31 days) the need for access should be reassured prior to extending the autneriza-tion.
To ensure that these actions are taken, the access list shall be reviewed and reapproved at least every 31 days.
4.
Void access authorizations for all personne[not satisfying the criteria in la&b and where appropriate, reprogram the key card system and reissue key cards that are coded to implement the above vital arc access authori-
'zation program.
5.
Develop reasonable alternatives so that the number and frequency of access to vital areas can be minimized consistent with safe operations.
6.
Establish emergency procedures where, during an emergency, additional authorized personnel, meeting criteria in la&b, can move freely throughout the vital areas with their entry and exit being recorded.
Upon securing from the emergency, the entry / exit record will be reviewed, and normal access control will be. reestablished. ~
7.
prevent tailgating by one or more of the folicwing:
Enclosure "C"
.I
IE Bulletin No. 79-16 July 26,1979 Page 4 of 4 Establish procedures'that require authorized personnel to prevent a.
other personnel, including those authorized unescorted access, from tailgating.
Ensure all authorized personnel are trained in the proce-dure, and establish a management program that ensures that the proce-d'ure is properly performed.
b.
Acquire equipment, such as turn $ tiles, to prevent tailgating.
Ensure that such equipment will not deny access or egress under emergency conditions.
Station a guard, watchperson or escort at the vital area access portal.
c.
This alternative would be most useful when there is a large number and frequency of access, such as occurs with containment during refueling.
By any other means that achieve this objective.
d 8.
Assign corporate responsibility for management oversight of VA access control and require perscnal involvement to ensure that all intermediate levels of management are properly discharging their responsibilities 'in this regard.
9.
Conduct routine functional tests of the electronic access control system, including each key card reader, to verify (1) its operability and proper performance, and (ii) the accuracy of the data recorded.
This test should be incorporated into the seven-day test required by 10 CFR 73.55(g).
/
- 10. Report in. writing within 45 days (for facilities with an cperating license) the actions you have taken and plan to take (including a schedule) with regard to Items 1 through 9.
Recorts shoold be submitted to the Director of the appropriate NRC Regional Office and a copy should be forwarded to the NRC Office of Inspection and Enforcement, Division of Safeguards Inspection, Washington, D.C.
20555.
Approved by GAO, B180225 (R0072); clearance expires 7-31-80.
Approval was given under a blanket clearance specifically for identified generic problems.
c Enclosure "C"
')
W uda},15Mj!!h]u g )sg en cm@iga tr CPcg%gg, O
.