ML20210L776

Reg Guide 5.65,Task SG 302-4, Vital Area Access Controls, Protection of Physical Security Equipment & Key & Lock Controls

ML20210L776
Person / Time
Issue date:	09/30/1986
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-RE, TASK-SG-302-4 REGGD-05.065, REGGD-5.065, NUDOCS 8610030129
Download: ML20210L776 (12)

Text

-

U.S. NUCLEAR REGULATORY COMMISSION Septamber 1988 k[.

h J" "+.$) REGULATORYGUIDE

..+

OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE 5.65 VITAL AREA ACCESS CONTROLS, PROTECTION OF PHYSICAL SECURITY EQUIPMENT, AND KEY AND LOCK CONTROLS (Task SG 302-4)

A. INTRODUCTION access for safety purposes while providing necessary physical security, (2) to provide protection of specified The NRC's principal requirements with respect to the physical security equipment which, if sabotaged, could protection of items of vital equipment at nuclear power significantly affect the security of the plant, and (3) to l

reactors are contained in 10CFR Part 73, " Physical provide guidance for key, lock, and combination changes Protection of Plants and Matuiais." These requirements when an employee with access to them leaves, are aimed at safeguarding against sabotage that could cause a radiological release. The Commission has pub-C. REGULATORY POSITION lished amendments to 10 CFR Part 73, Ig 73.55 and 73.70, that clarify safeguards policy for power reactors

1. PilYSICAL BARRIERS on control of access to vital areas during emergency and nonemergency situations, protection of certain physical 1.1 Openings in Vital Area Barriers (Excluding Doors) security equipment, and key and lock controls. These revised requirements were developed to clarify or According to paragraph 73.55(c), access to vital modify certain existing physical protection requuements.

areas requires passage through at Icast two physical The amendments were designed to foster plant safcty barriers of sufficient strength to meet the performance wlule maintaining adequate safeguards. This guide requirements of paragraph 73.55(a). Accordingly, no

[mj presents approaches that are acceptable to the NRC accessible openings in vital areas should exist. Ileating-(j/ staff for implementing the amendments. Emphasis in the ventilation-air conditioning ducts, cable tray penetrations, guide is on minimizing the safeguards impact on safety.

ventilation fans, etc. should be protected by gratings or other materials so that the integrity of the barrier is not Any information collection activities mentioned in decreased. In addition, the barrier should be constructed this regulatory guide are contained as requirements in of materials that provide delay to forced entry. Such 10 CFR Part 73, which provides the regulatory basis for materials should be resistant to cutting, drilling, and this guide. The information collection requirt ments in pur.cture by small hand tools or tool substitutes.

10 CFR Part 73 have been cleared under OMB Clearance No. 3150-0002.

Examples of hardening techniques are described in B. DISCUSSION the appendix. These techniques serve as guidelines for several cost-effective ways of increasing penetration The objective of controlling access to protected resistance time without impairing the function of the and vital areas of nuclear power reactors is to ensure penetration. Other techniques are acceptable, as long as that only authoriied persons with legitimate need be the penetration area is hardened at least to the level allowed access to such areas. This regulatory guide of the weakest part of the barrier.

describes measures the NRC staff considers acceptable to implement regulatory requirements on access controls.

The licersee should also ensure that safety systems g

The purpose of these measures is (1) to ensure adequate are not compromised by such barriers.

gn c_

y O

USNRC REGULATORY GUlOES The guides are issued in the following ten broad divisions:

Regulatory Guldes are issued to describe and make availab!e to the Fublic methods acceptable to the NRC staff of implernenting

1. Power Reactors

6. Products pg specific parts of the Commission's regulatloris, to delineate tech-

2. Research and Test Reactors

1. Transportation D

nlQues used by the staff in evaluating speClflC problems or postu-

3. Fuels and Materials Fac611tles

8. Occupational Health tated accidents or to provide guidance to appocants. Regulatory

4. Environmental and Siting

9. Antitrust and f inancial Review HOZ Gu6 des are noi substitutes for regulations, and compliance with S. Materials and Plant Protection 10. General OW th5m is not required. Methods and solutions different from those set (v) g lf)

O 4 G out in the guides will de acceptable if they provios a basis for the Copies of issued guides may be purchased from the Government O O

./

findings requisite to the issuance or Continuance of a permit or 4

t f l6c' nse by the Commission.

Printing Of f 6ce at the current GPO prlce. Information on current GPO prices may be obtained by contacting the Superintendent of WT.

\\v/ This guide was issued after consideration of comments received from Documents, U.S. Government Pr6nting Of fice, Post Of fice Box

4) Q C the pubHc. Comments and suggestions for improvements in these 3 7082, wasnington, DC 20013-7082, telephone (202)2 75 2060 or go guides are encouraged at all times, and guides will be revised, as (202)275 2171.

appropriate, to accommodate comments and to reflect new informa-tion or emperlence.

Written comments may be submitted to the Rules and Procedures information serv 6ce on a standing order basis. Details on this G ranch, DRR A DM, U.S.

Nuclear R egulatory Commissaon, service may be obtained by writing NTIS, 5285 Port Royal Road, W shington, Od. 20SSS.

Springfield, V A 22161.

l 1.2 Separation of Protected Area and Vital Area under an alternative safeguards approach, spent fuel Barriers at Water Sources pools could be included in vital areas during that period when the spent fuel pools pose a threat to public health Water sources designated as vital must be afforded and safety. After this initial period, licensees would have the protection measures required of a vital area under the option of relaxing the spent fuel pool safeguards.

g 73.55. These requirements, in part, state:

3. CONTROL OF ACCESS TO VITAL AREAS UNDER The licensee shall locate vital equipmsat only within a ROUTINE CONDITIONS vital area, which in turn, shall be located within a pro-tected area such that access to vital equipment requires 3.1 Access Lists passage through at least two physical barriers of suffi-cient strength to meet the performance requirements Paragraph 73.55(d)(7)(i)(A) requires that the licensee of paragraph (a) of this section. More than one vital establish current authorization access lists for each vital area may be located within a single protected area.

area. The access list should be updated and reapproved by the cognizant licensee manager or supervisor on the Protection of water sources designated as vital is last working day of each calendar month. The access list complicated by the wide-ranging configurations of these should include only those individuals whose specific sources and, in some cases, it is not practical to separate duties require that they have access to the vital area protected and vital area barriers to these sources, e.g., at during routine operations. Certain access controls may water intake structures, be suspended during emergency or abnormal plant conditions, and the list wauld be unnecessary under The intake structures for vital water sources located these circumstances. Therefore, the names of emergency at the main protected area barrier are considered to response personnel need not be on the list.

meet requirements for vital areas if the structure is Seismic Category I reinforced concrete and, in the case 3.2 Logging Requirements of the essential service water intake structure designated as vital, if the intake structure (1)is secured with Licensees are required to keep a log that indicates screening or grill to prevent introduction of large objects, name, badge number, time of entry, and time of exit of (2) has double barriers on any nonwater side that all individuals granted access to a vital area except to contains a movable opening, (3)is equipped with heavy-the reactor control room. The intent is to maintain a duty doors that provide delay to penetration, (4)is kept record of personnel access and egress for each specific under constant surveillance by closed circuit TV for vital area. This may be a:complished through the use of rapid assessment, and (5)is protectul by an intrusion computer-controlled access devices. A log documenting alarm system.

personnel access and egress for the reactor control room is not needed because this area is always occupied.

In all cases, associated piping, valves, pumps, and con.

trols should be either buried or enclosed in a substantial 3.3 Revocation of Access Authorization structure

• with hatches, ports, and other openings locked and alarmed. Manholes that provide access to vital equip.

Paragraph 73.55(d)(7)(1)(C) requires the licensee to ment or the protected area and are located within the revoke an individual's access authorization and retrieve ownercontrolled area should be locked and alarmed if that individual's identification badge and other entry the cover can be lifted without the aid of machinery.

devices, as applicable, prior to or simultaneously with the notification to the individual of the termination

2. TIME DEPENDENT VITAL AREAS (SPENT FUEL w hen the termination is involuntary and for cause.

Under these circumstances, the licensee should have in POOlli) place the mechanisms or procedures necessary to ensure Spent fuel pools are currently provided vital area pro-that such individuals cannot gain unescorted access to tection in accordance with I 73.55. Ilowever, it is recog-the site. This provision is intended to reduce oppor-nized that the radiation levels of spent fuel decay tunities for disgruntled individuals to have access to the rapidly after removal from the reactor core and eventu-reactor facility.

ally do not require vital area protection because the potential for a Part 100 release ** is remote. Accordingly, 3.4 Locks, Alarms, and Emergency Controls for Unattended Vital Area Doors In the interest of controlling access to vital areas in

'A substantial structure means a structure that meets the require.

ments of paragraph 73.2(f)(2) or its equivalent, the accomplishment of the safeguards objective, para-

The criteria in $ 100.11 of 10 CI'R Part 100 specify refer-graph 73.55(d)(7)(1)(D) requires that the licensee lock ence values to be used in the evaluation of reactor sites with respect and protect unoccupied vital areas hy an activatej to potential reactor accidents of exceedingly low probability of occurrence and low risk of public exposure to radiation. Those intrusion alarm system, e.g., a balanced magnetic switch.

reference values are a total radaation dose in excess of 25 rem to the whole body or a total radiation dose in excess of 300 rem to the thyroid from iodine exposure (based on a 2-hour exposure time The licensee should protect a vital area by maintain-commencing immediately following the onset of the postulated ing locks and alarms on all doors that are not attended nsaton product reinse).

5.65-2

acc:ss control points. Acceptable criteria for the use and 4.3 Loss af Electric P:wer -

selection of commercially available locks are found in Regulatory Guide 5.12, " General Use of Locks in the in order to facilitate safety, the licensee should

(

Protection and Control of Facilities and Special Nuclear provide for rapid ingress / egress during a computer or

\\

Materials." Descriptions of various surface protection power outage. If vital area doors are not specifically alarms and guidance on testing and maintaining alarm required by the licensee's physical security plan to systems can be found in NUREG-0320, " Interior intru-fail in the closed position upon loss of electric power, sion Alarm Systems."*

procedures that provide for prompt compensatory measures in opening locked doors should be established.

The licensee should install " panic" hardware and The following are acceptable procedures for providing establish procedures that permit rapid and orderly for safe ingress / egress during a power or computer egress from vital areas in the event of an emergency outage:

situation. Emergency exit doors that have " panic" hardware should be alarmed to the central and second-

1. Itave locks on interior vital area doors fail open ary alarm stations so the use of such doors can be during an outage or emergency and have guards immedi-monitored, ately deployed to monitor ingress / egress.

4. EMERGENCY ACCESS TO VITAL AREAS

2. Use an uninterruptible power supply system for electrical locking devices.

During cu:crgencies or abnormal conditions, it may be necessary for certain licensee personnel to gain

3. llave locks fail closed and provide keyed bypass quick access to vital equipment in order to mitigate or locks for vital areas. Ensure that all necessary personnel terminate some adverse plant condition. Also, it is have keys.

important to ensure that personnel can quickly evacuate vital areas if the emergency condition results in high

4. llave locks fait closed and install crash (" panic")

radiation or other dangerous conditions within the vital bars and alarms on doors for emergency ingress / egress.

area. Thus, paragraph 73.55(d)(7)(li)(A) requires that licensees ensure prompt access to vital equipment during

5. SUSPENDING SECURITY MEASURES emergencies or abnormal conditions. Licensees can provide for rapid ingress / egress during such conditions 5.1 Authority by providing backup keys to vital areas and methods of opening locked doors in the case of computer or power Paragraph 73.55(a) permits the licensee to suspend

failure, any safeguards measures pursuant to 9 73.55 in an emergency in accordance with paragraphs 50.54(x) and 4.1 Access Keys (y) of 10 CFR Part 50. If immediately needed to pro-tect the public health and safety, such suspension is in the event of an emergency or abnormal condition permissible provided that (1) the action taken is at a power reactor, it may be necessary for certain approved, as a minimum, by a licensed senior operator personnel, particularly an operator, to have prompt prior to the emergency action being implemented and access to vital areas or equipment. To facilitate access, (2) all safeguards measures are restored as soon as operating personnel should be provided with keys practicable following the suspension. This flexibility will to open doors that are locked for security or other accommodate the potential need for rapid response to purposes.

emergency or abnormal conditions.

4.2 Access Codes and Antipassback Control Features The licensee should specify in the physical security or contingency plan the individual, by title, responsible for It has been observed that the use of individual relaxing security requirements if necessary during emer-manually entered identification codes and the use of the gencies. The plan should also specify a chain of respon.

"antipassback" feature programmed into card key com-sibdity for suspension of safeguards requirements in the puters hamper ingress because of mistaken entries, event that the first designated individual is unavailable.

poor memories, entry denial for failure to log out of an area, etc. In order to minimize the impact on safety by 5.2 Conditions ensuring prompt access, the use of manually entered codes and the antipassback feature in vital area access The authority to suspend safeguards measures should control systems is not required or recommended by the be exercised only when site conditions are or may soon NRC.

become a danger to the public health and safety. Secu-tity measures should be relaxed only to the extent necessary to accommodate the emergency situation in accordance with paragraphs 50.54(x) and (y). Each on 3IOQ instance in which safeguards requirements are suspended

.$,$ve me int ns o e s

rice ment Washington, DC 20ol3 70s2.

without approved compensatory measures would have to 5.65-3

be reported to the NRC under the provisions of 5 73.71

• All emergency response personnel remain within as an event that lessens the effectiveness of safeguards.

view of the licensee's escort at all times, and 5.3 Controls That Can Be Suspended During an Emergency

. The licensee positively identifies at least one member of the emergency response team who The types of controls that could be suspended in an verifies that the other personnel are bons fide emergency might include but are not limited to the members of the responding organization.

following:

The access-safeguards requirements that may be

1. The search and identification of personnel required waived are:

by paragraph 73.55(d)(1),

. Search and identification of emergency response

2. The scarch of hand-carried items required by personnel, paragraph 73.55(d)(2),

. Search of emergency response vehicles,

3. The search of vehicles required by paragraph 73.55(d)(4),

. Search of hand-carried packages and equipment, and

4. The use of a badge identification system required by paragraph 73.55(d)(5),

. Badging and registration of emergency response personnel

5. The registration of personnel required by paragraph 73.55(d)(6), and The drill or exercise must stop at the vital area boundary; there is no regulatory authority for relaxation

6. The access controls for vital areas in paragraph of controls into vital areas during any nonemergency 73.55(d)(7).

situation. If it is considered necessary to familiarize the emergency response personnel with plant layout, 5.4 Use of Escorts including vital areas, the full security plan measures must first be applied.

In the event safeguards controls are suspended, the licensee should use escorts to the extent possible.

6. PliYSICALPROTECTION Pi AN AND CONTINGENCY Offsite response personnel should be escorted by desig.

PIAN INTERFACE nated licensee personnel with operable two-way radio communications to the central and secondary alarm Paragraph 73.55(d)(7)(ii) requires that the licensee stations. At least one escort should accompany each design the access authorization system to accommodate emergency vehicle, and all offsite emergency response the potential need for rapid ingress or egress of indi-personnel should be in tiew of the escort at all times viduals during emergency conditions or situations that unless this would constitute a danger to the escort. For could lead to emergency conditions. In order to facilitate the purpose of this guide, an escort is defined as a ingress / egress during such conditions, the licensee should member of the security organization or other designated conduct periodic reviews of security and contingency individual responsible for accompanying those personnel plans and ensure prompt access to vital equipment.

not allowed unescorted access within a protected area.

An escort is not required to possess a technical knowl-edge of the plant's processes or equipment.

6.1 Periodic Review of Security and Contingency Plans 5.5 Access Controls for Emergency Response During Paragraph 73.55(d)(7)(ii)(B) requires that the licensee Drills or Exercises periodically review physical security plans and contin-gency plans and procedures to evaluate their potential During a preplanned drill or exercise, the offsite impact on plant and personnel safety. The licensee emergency response personnel may enter the protected should conduct such review annually to ensure that areas, and certain access-safeguards requirements may be security procedures do not adversely affect the proce-waived provided that:

dures outhned for emergency or abnormal conditions.

Licensees should also review the plans whenever changes

. The NRC is notified in advance of the drdt what are made that could affect plant or personnel safety or measures will be waived and when the drill is when the licensee becomes aware of a procedure that scheduled, could affect safety. Licensees may use the Plant Opera-tions Review Cornmittee (PORC), quality assurance audit

• liach vehicle is escorted by a member of the programs, corrective action reporting systems, or other licensee's security organization equipped with two-appropriate programs to monitor the potential for way radio communication to the alarm station, safety / security impacts.

5.65 4

6.2 Cross-Training locks, and combinations at least every 12 months or whenever there is evidence or suspicion that any key, Interface problems between security and operations lock, combination, or related access control device has been compromised. Such suspicion may be interpreted

/m) are reduced when the respective st2ffs are made aware, as the reasonable belief that compromise has occurred (j through cross-training and indoctnnation, of the roles, even though physical evidence has yet to be uncovered.

responsibilities, and general practices of both organiza-tions. The licensee should provide personnel with oppor-Changes should also be made whenever a person who tunities to learn about the other organization.

had access to protected areas or vital areas is terminated for cause.

7. PROTECTION OF SECURITY EQUIPMENT Keys, combinations, and other access control devices Paragraph 73.55(e)(1) requires, in part, that onsite should be issued only to those individuals possessing an secondary power supply systems for alarm annunciation unescorted access authorization.

equipment and nonportable commuid.alion equipment I

be located in vital areas. Protectior. of these items of D. IMPLEMENTATION equipment is necessary to reduce vulnerabilities in the system because their sabotage could significantly impact The purpose of this section is to provide information to applicants regarding the NRC staff's plans for using the safeguards of a plant. Therefore, licensees are required to locate these pieces of equipment in vital this regulatory guide.

areas.

Except in those cases in which an applicant or licensee proposes an acceptable alternative method for

8. KEYS AND LOCKS complying with specified portions of the Commission's Paragraph 73.5 5(d)(9) requires, in part, that keys, regulations, the methods presented in this guide will be locks, combinations, and related access control devices used in the evaluation of security methods and proce-be controlled to reduce the probability of compromise.

dures for all operating plants and plants that have The licensee is required to change or rotate all keys, not received an operating license, b)

(J V

5.65 5

APPENDIX The purpose of this appendix is to provide examples

• CR-1378, "llardening Existing Strategic Special Nuclear of techniques pertaining to methods of hardening open.

Material Storage Facilities,"* June 1980.

I ings in ceilings and walls of vital areas.

' Copies may be obtained from the Superintendent of Docu-ments. U.S. Government Printing Office, Post Ornce Box 37082 Techniques I through 3 are excerpted from NUREG/

Washington, DC 20013-7082.

Technique No.1 l

Hardening Opening in Ceiling or Wall EXISTING STRUCTURE: Opening in ceiling or wall TOOLS REQUIRED FOR PENETRATION: Depends on existing opening PENETRATION TIME: Depends on existing opening IIARDENING ACTION:

1. Add strong steet jamb to opening.

2. Form three separate grates by welding No. 4 or No. 5 rebar into 6-inch (15-cm) grids. Weld grates to inside, center, and outer lips of jamb. (Another method is to weld six separate layers of rebar alternating vertical and horizontal and offset from each other.)

3. Add a baffic on inside for openings in vital areas if accessible.

INCREASED PENETRATION RESISTANCE TIME: Approximately 15 minutes ADDITIONAL PENETRATION TOOLS REQUIRED: Boltcutters ADVANTAGES OF TECIINIQUE:

1. Multiple layers to penetrate

2. Delay time can be increased by increasing either size of rebar or numbers of rebar.

O 5.65-6

,' lI

'I lJl ll l{lllll mU

-sL_

yI.

3 L

~

W

_A 3

5 E

W VI -

O I

P NR O

R R A B

T O

O E R

.gd

4. R O

_l j

_E 8

N O

D N -

%W'

- =

E l

i L B E M ET A S J C.

g

_ E=E=E i

S E

M TUN M

E I

I E

NG R

U M

MS T

I E

C M

I 7 D RE M

T 2

UW I

N

- N

. L O

5O TI L

SV L I

L I

YU 1 P M

A T

DE A ED W

. W A

L G I

R E

NI I

N S

T T

I M

E AD E

D N

MN I

R E

I E

I M

A P

XP o

H OE N

RD D

P e

A u

I E

P pt

!E=EmE i

iL SSR A

q i

TOA n

NLB hc L

ECE e

L S GR T

A E N4 W

R I

P NO E

L EN R P L

A EOHT L "4 W W

I PM2 AxP X

U E "2 E

2 E

R M

U I

T T

C W U

N E

O RI L

L I

TV L N

L T

0 S

E E A A

A P

GD W O

W R

NI T

I S E

T N

S I

E X

P E

L L

AW

,g l

r l

Technique No.2 Herdening a Duct in a Ceiling or Well Where Air Flow is Required EXISTING STRUCTURE: Duct opening in ceiling or wall where air flow is required TOOLS REQUIRED FOR PENETRATION: Depends on existing opening PENETRATION TIME: Approximately 1 minute for a 24 x 24 in. (61 x 61 cm) duct (horizontal)

IIARDENING ACTION:

1. Line duct with coils of general purpose barbed tape obstacle (GPBTO) or concertina, if coils cannot be used, bands or ribbons of barbed tape can be riveted to walls.

2. Attach diffusers with 16 quarter-inch bolts.

INCREASED PENETRATION RESISTANCE TIME: Approximately 10 minutes ADDITIONAL PENETRATION TOOLS REQUIRED: Depends on installation method for barbed tape ADVANTAGES OF TECl!NIQUE:

1. Greatly hampers crawl-through

2. Various installation methods allow upgrading with minimal effects on duct performance.

O O

5.65-8

s t

l O

o B

O T

4 B

/

P 1

G

)

en rw uo th cS urt w s

t oe e

SNi tu V

ds E_

n ert M

i h

I M

nen T

eso d ur 0

rfF N

1 af l

O Hi l

I y

D a

T l

t A

e

(

i R

t T

a E

m N

i E

x P

o E

• rpp r

A iA

/

2

.oN e

o iqu n

hceT

)

en rw uo

~^

"4 th cS

~

2 u

I rt w toe SNi e

V t

gs l

E u

nrt l

M n

i en a

I f

i-t so W

T T

sur 4

ifF 2

N 1

xf O

Ei I

y D

T l

(

A e

R t

T a

E m

lr N

i E

x P

or p

i p

A A

/

O ll

A Technique No.3 Hardening Opening in Ceiling or Wall Where Air Flow is Required EXISTING STRUCTURE: Opening of any size TOOLS REQUIRED FOR PENETRATION: Depends on existing opening PENETRATION TIME: Depends on existing opening IIARDENING ACTION:

1. Add strong steel jamb to opening.

2. Weld steel pipes no larger than 3 inches (7.5 cm) in diameter together and then weld to steel jamb.

INCREASED PENETRATION RESISTANCE TIME: More than 15 minutes ADDITIONAL PENETRATION TOOLS REQUIRED: Cutting torch ADVANTAGES OF TECilNIQUE:

1. Allows air flow.

3. Reduces bodily access.

O O

5.65-10

O EXISTING OPENING HARDENED OPENING TOP VIEW SIDE VIEW SIDE VIEW y!$fd i;

WALL WALL INSIDE fN ^

OUTSIDE h?$

I

\\

STEEL j

PIPE AIR WALL OPEN WALL WALL WALL

/

5Y STEEL

_.[![NINMP I

~'

JAMB WE LD JOINTS WALL WALL y,WALLQ?

MAX 3" DIA.

H 8" - *{

PENETR ATION TIME PENETRATION TIME I

DEPENDS ON EXISTING OPENING APPROXIMATELY 49 MINUTES l

Technique No. 3

VALUE/ IMPACT STATEMENT A separate value/ impact statement has not been pre-

73. A value/ impact statement prepared for these amend-pared for this regulatory guide. The guide was developed ments was made available in the NRC Public Document to present approaches acceptable to the NRC staff for Room at the time they were published. This value/

fostering plant safety while maintaining adequate safe-impact statement is also appropriate to this regulatory guards in accordance with amendments to 10 CFR Part guide.

UNITED STATES n., et,ss una NUCLEAR REGULATORY COMMISSION postaos e nas ram WASHINGTON, D.C. 20555 wIs**"o"c eERMI, No a 87 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. 4300 1 10P11S 9dk 120555064215 US NRC

~hhiCON OL CESK-RECSB g

042 OC 20555 WASHINGTON O

5.65-12