ML20155A422

Forwards Comment on Rev to Nuclear Science Center Physical Security Plan Submitted by Ltr Dtd 980916.Use Guidance Provided in Reg Guide 5.59 to Address Development of Rev to Security Plan in Response to Comments

ML20155A422
Person / Time
Site:	05000128
Issue date:	10/22/1998
From:	Michaels T NRC (Affiliation Not Assigned)
To:	Okelly S TEXAS A&M UNIV., COLLEGE STATION, TX
References
RTR-REGGD-05.059, RTR-REGGD-05.062, RTR-REGGD-5.059, RTR-REGGD-5.062 GL-91-03, GL-91-3, TAC-MA0861, TAC-MA861, NUDOCS 9810290092
Download: ML20155A422 (9)

Text

_ - _ ~ . _ _ ___ _ _ _ --._- _ _ . . . _ .

6

• October 22, 1998 Dr. Sean O' Kelly, Assistant Director Nuclear Science Center Texas Engineering Experiment Station Texas A&M University System College Station, Texas 77843-3575

SUBJECT:

REVISION TO NUCLEAR SCIENCE CENTER PHYSICAL SECURITY PLAN

, (TAC MA0861)

Dear Dr. O' Kelly:

We have reviewed the revision to the Nuclear Science Center Physical Security Plan submitted by your letter dated September 16,1998. Our review has developed additional comments which are included in the enclosure to this letter.

In the development of revisions to your security plan to address these comments, please use the guidance provided in Regulatory Guide 5.59, " Standard Format and Content for a Licensee Physical Secenty Plan for the Protection of Special Nuclear Material of Moderato

^

or Low Strategic Significance," Regulatory Guide 5.62 " Reporting of Safeguard Events,"

and Generic Letter 91-03.

If you have any questions, please call me at (301) 415-1102.

Sincerely, Original Signed By; Theodore S. Michaels, Sr. Project Manager Non-Power Reactors and Decommissioning Project Directorate j Division of Reactor Program Management  !

Office of Nuclear Reactor Regulation l Docket No. 50-128 l

Enclosure:

As stated 1 cc w/ enclosure: See next page -

' Q{ I DISTRIBUTION:

E-MAIL HARD COPY

~

TBurdick TDragoun l Docket File 50-128 JRoe PDoyle MMendonca PUBLIC SWeiss CBassett WEresian EHylton PDND r/f AAdams SHolmes TMichaels ' OGC (015-B18 Pisaac DGordon Region lV PDND:PM,p Pp fLA PSGB '

Ph TMichaels@ on DGor SWe ss Io / 21/98 /0 /98 /0 /$/98 P /p/98 OFFICIAL RECORD COPY DOCUMENT NAME: G:\SECY\MICHAELS\0 KELLY.TM 9810290092 981022

,y, }

, , 4 UNITED STATES j l o e NUCLEAR REGULATORY COMMISSION WASHINGTON D.C. 2066tHXc1 l '+,..... October 22, 1998 Dr. Sean O' Kelly, Assistant Director Nuclear Science Center I Texas Engineering Experiment Station Texas A&M University System College Station, Texas 77843-3575

SUBJECT:

REVISION TO NUCLEAR SCIFNCE CENTER PHYSICAL SECURITY PLAN (TAC MA08611

Dear Dr. O' Kelly:

We have reviewed the revision to the Nuclear Science Center Physical Security Plan submitted by your letter dated September 16,1998. Our review has developed additional comments which are included in the enclosure to this letter.

In the development of revisions to your security plan to address these comments, please use the guidance provided in Regulatory Guide 5.59, ' Standard Format and Content for a l Licensee Physical Security Plan for the Protection of Special Nuclear Material of Moderate or Low Strategic Significance," Regulatory Guide 5.62 " Reporting of Safeguard Events,"

and Generic Letter 91-03.

If you have any questions, please call me at (301) 415-1102.

Sincerely,

& S.

Theodore S. Michaels, Sr. Project Manager Non-Power Reactors and Decommissioning Project Directorate Division of Reactor Program Management Office of Nuclear Reactor Regulation Docket No. 50-128

Enclosure:

As stated cc w/ enclosure: See next page

l4  ;

L:

l3 '

Texas A&M University Docket No. 50-59/128 cc:

Mayor, City of College Station P. O. Box Drawer 9960 College Station, Texas 77840-3575 l

Governor's Budget and Planning Office P. O. Box 13561 Austin, Texas 78711 Bureau of Radiation Control

. State of Texas 1100 West 49th Street Austin, Texas 78756 Dr. Warren D. Reece Director, Nuclear Science Center Texas Engineering Experiment Station Texas A&M University System F. E. Box 89, M/S 3575 College Station, Texas 77843 I

- - - . . - - . . - . - . . _ - - - - . -- . - .~ - . _ . .-

l ENCLOSURE l COMMENTS ON THE l TEXAS A & M PHYSICAL SECURITY PLAN SUBMITTED BY LETTER DATED SEPTEMBER 16,1998

1. Previous Reviewer Comment: Page 12, paragraph 3.c -- The plan does not address the 10 CFR 73.67(d)(1) and (2) illumination requirements -- i.e., that special nuclear material of moderate strategic significance be used and/or stored "only within a controlled access area which is illuminated sufficiently to allow detection and surveillance of unauthorized penetration or activities." While paragraph 3.c.i(3) on page 12 does address the illumination of CAA " access points," this is not equivalent to illumination of the CAA.

New Comment: The Nuclear Science Center (NSC) response is NOT considered sufficient for the following reasons:

a. Paragraph 3.c.i(3) does not adequately addresa the requirements of 10 CFR 73.67(d)(1) and (2) in that it states "All access points and internal areas of the Controlled Access Areas shall be illuminated cufficiently for intrusion detection." The term " internal areas" does not clearly identify those areas that require illumination, i.e., that SNM of moderate strategic significance will be used and/or stored "only within a controlled access area which is illuminated sufficiently to allow detection and surveillance of unauthorized penetration or activities."

b. Paragraph 3.c.i(3) does not adequately address the requirements of 10 CFR 4 73.67(d)(1) and (2) because it does not specify that CAAs designated for use I and/or storage of SNM of moderate or low strategic significance will be Vault l type rooms or approved security cabinets (or their equivalent) or that such l areas will be illuminated sufficiently to allow detection and surveillsnce of unauthorized penetration or activities.

2. Previous Reviewer Comment: Page 15, paragraph 3.c.v -- The plan describes the badges as being used "to monitor personnel access levels," which is not equivalent to the requirement in 10 CFR 73.67(d)(5) which says "to identify and limit access to the controlled access areas to authorized individuals."

New Comment: NSC response is NOT considered sufficient for the following reasons:

a. Paragraph 3.c.v(1); "A system of distinct identifying badges will be used to monitor personnel access levels" does not adequately addresses the requirements of 10 CFR 73.67(d)(5) as follows:

(1) The meaning of the phrase "...to monitor personnel access levels" is vague and unclear.10 CFR 73.67(d)(5) requires licensees to develop and maintain a controlled badging and lock system to identify andlimit access to CAAs to only authorized individuals. "

1

2 (2) The phrase "A system of distinct identifying badges will be used..." does not adequately describe the chosen system or depict the licensee's approach to meet the requirements of 10 CFR 73.67(d)(5). (See Regulatory Guide 5.59 " Badging System").

b. Paragraph 3.c.v(2) states: " Prior to issuing any type of badge, the indivictual requesting a badge shall be screened by NSC administration personnel." This does not adequately address the requirements of 10 CFR 73.67(d)(4) as follows:

(1) This paragraph seems to imply that all personnel (employees and visitors, alike) will be screened equally, " Prior to issuing any type of badge".

(2) This paragraph is considered too vague in that it simply makes a blanket statement that the individual requesting a badge shall be screened but does not adequately depict the licensee's approach to meeting the requirement, such as the type of information to be gathered and the criteria upon which access authorization determinations will be made. See Regulatory Guide 5.59, Pad 1, Saction 3, paragraph 3.1, "Preauthorization Screening" and comment 6, below.

c. Paragraph 3.c.v(3) states, in part: "The NSC receptionist shall identify all personnel who enter the NSC Restricted Area..." This does not address the requirements of 10 CFR 73.70(c) or (d) which require a register of all visitors, vendors, and other individuals not employed by the licensee (10 CFR 73.70(c); and a log indicating narne, badge number, time of entry, and time of exit of allindividuals granted access to a vital area except those individuals entering or exiting the reactor control room (10 CFR 73.70(d).

3. Previous Reviewer Comment: Page 16, paragraph 3.c.vi(2)(b) and (c) -- The plan says visitors will be "under the constant supervision of an escort" and that escorts will have

" current site-specif;c cecurity training." However,10 CFR 73.67(d)(7) requires that all visitors to controlled access areas must be under the constant escort of an individual who has been " authorized access to the area." Note that having " current site-specific security training' is not equivalent to being " authorized access to the area."

New Comment: Paragraphs 3.c.vi(2)(c) was revised to conform with 10 CFR 73.67(d)(7), however, the NSC response is NOT considered sufficient for the following reason: Paragraphs 3.c.vi(2)(b) and (c) do not address maximum ratio between the number of escorted individuals and the number of escorts, as deemed appropriate by the licensee. See Regulatory Guide 5.59, Part 1, Section 3, paragraph 3.5, " Escort System".

4. Previous Reviewer Comment: Page 18, paragraph 3.f.i(2)(d) -- Reference is made to regulation 10 CFR 73.71(c)(2). Please explain the relevance of this regulation to this paragraph or eliminate the reference.

3 Unv Comment: NSC response is acceptable. Reference was deleted 10 CFR 73.71(c) does not contain a subparagraph (2). Please Note: Neither 10 CFR, Part 73, Appendix G, nor 10 CFR 73.71 require licensees to submit quarterly reports of loggable events.

i

5. Previous Reviewer Comment: 10 CFR 73.67(d)(11) requires licensees to " establish and maintain written response procedures for dealing with threats of thefts or thefts of these materials" and prescribes retention and record-keeping requirements. The plan does not address these requirements. Paragraph 4.f. of the plan does give procedures for notifying the NRC, but does not refer to written response procedures.

New Comment: NSC has misunderstood this comment. Although paragraph 5.a.i does state: "The Physical Security Plan is implemented, in part, by detailed written Standard Operating Procedures (SOP)", the licensee must provide a commitment to written procedures that willimplement 10 CFR 73.67 requirements. There is a material difference between simply stating that procedures exist and committing to compliance with the 10 CFR sections that define the procedural requirements.

6. General.

Previous Reviewer Comment: The plan does not address the 10 CFR 73.67(d)(4) requirement that individuals be screened " prior to granting unescorted access to the controlled access area where the material is used or stored, in order to obtain information on which to base a decision to permit such access.

New Comment: Statements concerning this requirernent are vague. See paragraph 2, ,

above. The blanket statement made on page 15, paragraph 3.c.v does not indicate that I the licensee's approach to meet the " screening" requirement will be in conformance with 10 CFR 73.67(d)(4). The licensee does not describe the screening process to be implemented, or the types of information to be obtained, evaluated, and used to base a decision to grant or deny access. Regulatory Guide 5.59,Section I, paragraph 3.1, "Preauthorization Screening" provides guidance which may clarify the requirements associated with screening of personnel. The intent of the requirement for screening is to ensure that the licensee will have sufficient knowledge about an individual to i determine his/her trustworthiness and reliability prior to granting authorized access.

The selection of procedures to be used, information to be gathered, and the criteria upon which a final access determination will be made are the responsibility of the licensee. The screening process could be conducted in the same manner as other

investigations normally conducted by potential employers. Examples include i examination of past employment and educational records; comacting references, teachers, or colleagues; present employment record; recently held government or military clearance; etc.

J

7. Additional Comments:

1 i a. This physical security plan addresses some responses to safeguards events but does I not specifically commit to ensuring that at least one (1) watchman per shift will be i

i d

4

l E

4 available to assess and respond to any unauthorized penetrations or activities in the controlled access areas as is required by 10 CFR 73.67(d)(8).

b. This physical security plan does not clearly identify CAAs as being designated for "use", " storage", or "use and storage" of SNM of Moderate or Low Strategic Significance and does not clearly commit to the requirements of 10 CFR 73.67(d)(1) and (2) which requires that SNM of Moderate or Low Strategic Significance be used only within a CAA and stored within a CAA such as a vault-type room or approved security cabinet, or their equivalent (see paragraph 1 above).

c. Page 7, paragraph 2.a.i(3) states: " Entry into a Controlled Access Area during normal working hours by unauthorized personnel shall be considered a Levei 3 Security threat". Page 8, paragraph 2.a.ii(1) states: " Entry into a vital area by an unescorted visitor during normal working hours shall be considered a Level 3 Security Threat". Page 18, paragraph 3.f.i(1)(a) of this plan states: "A level 3 l Security Threat will be reported to the Director or his designate and a written report placed in the Security File within 30 days. Page 18, paragraph 3.f.i(1)(b) states: "A l NRC notification is not required for a Level 3 Security Threat." These paragraphs I are not consistent with 10 CFR PART 73 APPEND!X G or Generic Letter 91-03 for the following reasons:

(1) 10 CFR Part 73, Appendix G, paragraph l'b) requires that an actual entry of an l unauthorized person into a protected area, material access area, controlled access area, vital area, or transport be reported to the NRC Operations Center within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

(2) Generic letter 91-03 reduced the reporting requirement for this type of event, but only under very specific conditions. The above paragraphs are very broad in i

scope and are not consistent with the scope of Generic Letter 91-03 as it applies to these types of events,

d. Page 8, paragraph 2.a.iii(1) states: "The receipt of a bomb threat either verbally or in writing shall be considered a Level 2 Security Threat". This paragraph is contradictory to 10 CFR Part 73, Appendix G which requires that all " credible" threats to cause significant damage, be reported within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. However, it is recognized that, not all bomb threats are credible and some discretion concerning reportability is left to the licensee. The licensee must make a determination regarding the " credibility" of a given bomb threat and make a determination regarding its reportability within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of receipt of the threat. (See Regulatory Guide 5.62 (Rev.1) " Reporting of Safeguards Events").

e. This plan does not clearly commit to the requirements of 10 CFR 73.70 concerning records. Page 7, paragraph 2.a.i does not address the requirement of 10 CFR 73.70(c) to register all visitors, vendors, and non-employees. Page 7, paragraph 2.a.i does not address the requirement of 10 CFR 73.70(d) to maintain a log indicating narne, badge number, time in and out, of all personnel granted access to a vital area.

. .. . .. .- . - ...- - - .. . . _ _ . - _ _ _ . - . .- - ~.-.- . - ..-. . . _ - . .-.. - -

i

1. Editorial comment: 1

)

a. Page 6, paragraph 1.d.iii -- change the word "of" to the word "or" A violation of the security procedures without intent to commit a theft of / sic / radiological sabotage, l

- b. Page 12, paragraph 3.c.i(3) -- second line - insert the word "be" betweer. "shall" and " illuminated". "All access points and internal areas of the Controlled Access Areas shall(siclilluminated sufficiently for intrusion detection.

l l

U 1

4

- _ . .._, - .- __ --- , _ _- .- -- - - ,, . -