ML19296D015

Criteria Dealing W/Access Controls to Vital Areas

ML19296D015
Person / Time
Issue date:	12/21/1979
From:	NRC OFFICE OF STANDARDS DEVELOPMENT
To:
Shared Package
ML19296C882	List: ML19296C881 ML19296C887 ML19296C895 ML19296C898 ML19296C901 ML19296C907 ML19296C919 ML19296C923 ML19296C931 ML19296C936 ML19296C942 ML19296C944 ML19296C958 ML19296C965 ML19296C970 ML19296C975 ML19296C979 ML19296C982 ML19296C983 ML19296C984 ML19296D015 ML19296D017 ML19296D018 ML19296D025 ML20008D726
References
REF-10CFR9.7 SECY-79-682, NUDOCS 8002290221
Download: ML19296D015 (3)

Text

CRITERIA DEALING WITH ACCESS CONTROLS TO VITAL AREAS 10 CFR 73.55(a) requires licensees to protect against industrial sabotage by an insider, including an employee (in any position).

10 CFR 73.55(d)(7) states that access to Vital Areas shall be positively controlled and limited to individuals who are authorized access to vital equipment and who require such access to perform their duties.

Specific commitments implementing this regulation are described in each licensee's approved Security Plan.

NRR, in meetings with licensees in March 1977, to discuss 73.55 and the components of an acceptable physical security plan, explained that positive control of access to vital areas consisted of two elements:

one, to be author-ized access to a Vital Area, the individual requesting entry must have the necessary background screening and a need to perform job related functions in the area, and two, to have a need at that specific time to enter the Vital Area to perform a specific function.

This is comparable to gaining access to a classified document; one must have both a clearance and a need-to-know.

In approving security plans, NRR has assumed that the determination of need would be based upon a valid need and not convenience.

Furthermore, access should be authorized to a minimum number of people, and licensees should use a reasonable basis to determine this restricted number of authorized personnel and the frequency of their access.

Acceptance Criterion 5.B of the Security Plan Evaluation Report (SPER)

Workbook, dated January 1978, states that the licensee must commit to providing positive access control to Vital Areas by:

1)

Limiting access only to authorized personnel.

2)

Requiring positive identification prior to entry.

8 0 0 2 29?M 1

Enclosure "B"

3)

Requiring an established need for access.

4)

Maintaining records of entry, exit, and reason for entry.

5)

Providing a system for personnel control within the Vital Area.

NRR Review Guideline #21 suggests that blanket access authorizations should not be granted.

Instead, an acceptable method of indicating Vital Areas to which access is authorized should include a record of each vital area to which the holder of a key card is authorized access, and the key card be encoded to permit access only to those Vital Areas to which an individual has been granted access.

Review Guideline #23 states that for access to a Type I Vital Area, the person must be authorized entry by the shift supervisor or other designated individual who has been informed of the estimated length of time to be spent in the Type I Vital Areas.

~

2 Enclosure "B"

4 Yh:ph'

:e 1

r,e

• )'#

o e,-

. w'

.' d) (3) ~

D EtiCLOSURE C

Enclosure "C" UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF INSPECTION AND ENFORCEMENT WASHINGTON, D.C.

20555 July 26, 1979 IE Bulletin No. 79-16 VITAL AREA ACCESS CONTROLS

.[

Description of Circumstances:

An attempt to damage new fuel assemblies occurred recently at an operating nuclear reactor facility.

During a routine fuel inspection, the licensee discovered that a chemical liquid had been poured over 52 of 64 new fuel assemblies.

Analysis indicates that the chemical liquid was scdium hydroxide, a chemical stored and used dnsite.

The licensee stores new fuel assemblies in dry storage wells en the same elevation as the spent fuel poql within the Fuel Building, a vital area.

Access to the building is controlled by use of a coded keycard which elec-tronically unlocks the alarmed personnel portals.

The licensee issues coded keycards to both licensee and contractor personnel after the successful com-pletion of a background screening program.

In addition, licensee site manage-ment certifies monthly that each individual has the need for a coded keycard in order to perform required duties.

Further access within this building is not limited by other barriers or controls.

As a result of this incident, an initial licensee audit determined that several hundred licensee and centractor personnel had access to this area during the period when the attempt to damage the fuel was made.

The audit also revealed that one coded keycard reader at a vital area portal was inaccurately recording access data at the alana station.

Also discovered during this audit were indications of frequent " tailgating" on access through the portals.

Tailgating occurs when more than one person passes through a portal en one persen's authorized access.

Their passage is therefore not recorded, and unauthorized persons could gain entry in this manner.

Tailgating does not include author-ized access controlled by an escort.

Discussion of Applicable Requirements:

10 CFR 73.55(a) requires the li:ensees to protect against :ndustrial sabotage ccanitted by an insider in any position.

10 CFR 73.55(d)(7) states that access to Vital Areas shall be positively controlled and limited to individuals who arq authorized access to vital equipment and who require such access to perfonn their duties.

Specific commitments ic;nenting this regulation are described in each licensee's approved Security plan.

' S 'V

- ) dye Q 79 0 70 L

IE Sulletin No. 79-16 July 25,1979 Page 2 of 4 NRR, in their meetings with the licensees in March 1977 to explain 5 73.55 and what would constitute an acceptable plan, explained that positive control of access to a vital area consisted of two elements:

first, that the eerson requesting. entry has the necessary background screening and need to perfom job related functions to be a'.'thorized access to that Vital Area, and second, that he has a need at that specific time to enter to perform a specific func-tion.

This is comcarable to gaining acciss to a classified document; you need both a clearance and a need to know.

In approving security plans, NRR assumes that the determination of need would be based upon a valid need and not convenience.

Furthermore, access should be authorized to a minimum number of people, and licensees should use reason-able altarnatives to minimize the number of personnel and frequency of access.

Acceptance Criterion.5.S of-the Security Plan Evaluatien Report (SPER)

Workbook, dated January 1978, states that the licensee must co= nit to pro-viding positive access control to Vital Areas by:

1)

Limiting access to authorized personnel.

2)

Requiring positive identification prior to entry.

3)

Raquiring an established need for access.

4)

Maintaining records of entry, exit and reason for entry.

5)

A system for control within the Vital Area.

NRR Review Guideline #21 suggests that blanket access authorizations should not be granted by stating that an acceptable method of indicating the Vital Areas to which access is authorized includes a record of each vital area to which the holder is authorized access, and the card is encoded to permit access to enly those Vital Areas to which the individual has been granted access.

Review Guideline J23 states that for access to a Type I Vital Area, the person must be authorized entry by the shift supervisor or other designated individual who has been informed of the estimated length of time to be spent in the Type I Vital Area.

There needs to be some balance attained between operational necessity and the administrative burden of validating the need for access each time entry is to be afforded.

Many licensees grant " permanent access authorization" to all 7

persons requiring access to vital areas, regardless of the frequency or dura-tion of the need.

This is contrary to the regulations and guidelines frcm NRR cited above.

Enclosure "C" O

IE Sulletin No. 79 16' July 25,1979 Page 3 of 4 Acticn to be Taken by Ticensee:

l ~.

Establish ci-iteria for granting unescorted access to each vital area, which shall be based upon the following:

a.

A screening program meeting ANSI N18.17.

i I

b.

The individual has a valid need for access to the equipment contained in each vital area to which access is authorized.

Valid need is based upon assigned duties requiring the performance of specific tasks upon or associated with specific equipment located in each vital area to which access is granted.

Valid need to enter cne vital area shall not necessarily indicate that the person has a need to enter any other vital area.

~

2.

An access list will be established for each area not to exceed 31 days.

An individual will' be on the access list only for the duration of the task to be p'erformed.

If an individual has a valid need for unescorted access for a single entry or for intermittent occasions during this period, a separate daily access list shall be prepared.

All access lists shall be approved by the station manager (or equivalent) or his designated representative.

3.

Individuals will be. removed from the access list irmediately upon termination of need.

If an individual has not entered the vital area during the effective pericd of the access list (not to exceed 31 days) the need for access should be reassured prior to extending the authoriza-tion.

To ensure that these actions are taken, the access list shall be reviewed and reapproved at least every 31 days.

4.

Void access authorizations for all personnel not satisfying the criteria in la&b and where appropriate, reprogram the key card system and reissue key cards that are coded to implement the above vital area access authori-zation program.

5.

Develop reasonable alternatives so that the number and frequency of access to vital areas can be minimized consistent with safe operations.

5.

Establish emergency procedures where, during an emergency, additional authorized personnel, meeting criteria in la&b, can move freely throughout the vital areas with their entry and exit being recorded.

Upon securing from the emergency, the entry / exit record will be reviewed, and normal access control will be. reestablished. ~

7.

prevent tailgating by one or more of the following:

Enclosure "C"

.I

IE Bulletin No. 79-16 July 26,1979 Page 4 of 4 Establish procedures' that require authorized personnel to prevent a.

other personnel, including those authorized unescorted access, from tailgating.

Ensure all authorized personnel are trained in the prece-dure, and establish a management program that ensures that the prece-dure is properly performed.

i b.

Acquire equipment, such as turnstiles, to prevent tailgating.

Ensure that such equipment will not deny access or egress under emergency conditions.

Station a guard, watchperson or escort at the vital area access portal.

c.

This alternative would be ecst useful when there is a large number and frequency of access, such as occurs with containment during refueling.

'. By any other means _that achieve this objective.

d 8.

Assign corporate responsibility for management oversight of VA access control and require personal involvement to ensure that all interrediate levels of management are properly discharging their responsibilities 'in this regard.

9.

Conduct routine functional tests of the electronic access control system, including each key card reader, to verify (i) its operability and prorer performance, and (ii) the accuracy of the data recorded.

This test should be incorporated into the seven-day test required by 10 CFR 73.55(g).

/

10. Report in. writing within 45 days (for facilities with an cperating license) the actions you have taken and plan to take (including a schedule) with regard to Items 1 through 9.

Reper:s should be submitted to the Director of the appropriate NRC Regicnal Office and a copy should be forwarded to the NRC Office of Inspection and Enfercement, Division of Safeguards Inspection, Washington, D.C.

20555.

Approved by GAO, B180225 (RC072); clearance expires 7-31-80.

Approval was given under a blanket clearance specifically for identified generic problems.

Enclosure "C"

'A

A O

g cc. a C< x y.V QNg;N)

Fs s ss'/

=\\.-- s' g,

,s.

g

[,

' N)[

sg.')

f, Z'

'c,

st s

s/

g'.

(

's 4

N.

A s

/.,se n ',

((o)'. s '

s s

ENCLOSURE D s