ML20236V666

Rev 1 to Reg Guide 5.62, Reporting of Safeguards Events

ML20236V666
Person / Time
Issue date:	11/30/1987
From:	Office of Nuclear Reactor Regulation
To:
References
TASK-RE, TASK-SG-901-4 REGGD-05.062, REGGD-5.062, NUDOCS 8712040456
Download: ML20236V666 (12)

Text

• Revision 1 U.S. NUCLEAR REGULATORY COMMISSION November 1987 o @[@ REGULATORY

• • • o OFFICE OF NUCLEAfs REGULATORY RESEARCH GUIDE REGULATORY GUIDE 5.62 (Task SG 9014)

REPORTING OF SAFEGUARDS EVENTS A. INTRODUCTION discovery of the event, and a detailed written report trust follow within 30 days.

In 10 CFR Part 73, " Physical Protection of Piants and Materials," paragraphs 73.71(a) through (c) have recently Certain other less significant safeguards events are been amended. Section 73 71 requires licensees to report required to be recorded in a log and copies of the to the Operations Center of the NRC or to record for recorded log submitted to the NRC every 3 months. While quarterly transmittal to the NRC certain safeguards these events ate less significant than those reportable events. These events are those that threaten nuclear within I hour, they are required to De reported to the activities or lessen the effectiveness of a security system as NRC on a quarterly basis for review and long term trend established by safeguards regulations or an approved analysis. If an event occurs repeatedly at one facility or security or contingency plan. throughout the industry, it may represent a defect in the

(

security program or a generic trend. Not all generic This regulatory guide provides an approach acceptable defects or trends require action on the part of the NRC; to the NRC staff for use by the licensee for determining however, this decision cannot be made unless the events when and how an event should be reported. The examples are reported to the NRC. Licensees have been required to provided represent the types of events that should be maintairi a separate log to record events reportable under reported and are not intended to be all-inclusive. The 73.71 in the past, but are now required to submit a applicability of events may vary from site to site. copy of that log to the NRC on a quarterly basis.

Any information collection activities mentioned in For the purposes of this guide and for understanding this regulatory guide are contained as requirements in the regulations, a glossary is given in Appendix A of this 10 CFR Part 73, which provides the regulatory basis for guide. Table I presents a summary of reportable events this guide. The information collection requirements in and reporting times.

10 CFR Part 73 have been cleared under OMB Clearance No. 3150-0002. C. REGULATORY POSITION B. DISCUSSION 1. LICENSEES SUBJECT TO 73.71 The information reportable under 73.7) is required Licensees who are subject to the provisions of so the NRC will be informed of safeguards-related events @ 73.25, 73.26, 73.27(c), 73.37, 73.67(c), or 73.67(g) that have the potential to endanger public health and of 10 CFR Part 73 are subject to the provisions of para-safety or national security. The required information is graph 73.71(a).

also used to monitor trends in safeguards system effectiveness. Licensees who are subject to the provisions of

@ 73.20, 73.37, 73.50, 73.55, 73.60, or 73.67 are Because certain significant safeguards events wartrat subject to the provisions of paragraph 73.71(b) for events immediate involvement by the NRC and possibly other described in paragraph (1)(a)(1) of the new Appendix G to government agencies such as the FBI, these events must be Part 73. Licensees subject to the provisions of Q 73.20, reported by telephone to the NRC within Ihour of 73.37, 73.50, 73.55, 73.60, or each licensee possessing USNRC REGULATORY GUIDES The guides are issued in the following ten broad divisions:

Regulatory Guides are issued to describe and make available to the public methods acceptable to the NRC staff of implementing 1. Power Reactors 6. Products specific parts of the Commission's regulations, to delineate tech- 2. Research and Test Reactors 7. Transportation niques used by the staff in evaluating specific problems or postu- J. Fuels and Materlats Facilities 8. Occupational Health lated accidents, or to provide guidance to applicants. Regulatory 4. Environmental and Siting 9. Antitrust and Financial Review Guides are not substitutes for regulations, and compliance with 5. Materials and Plant Protection 3 0. General them is not required. Methods and solutions dif ferent from those set out in the guides wiH be acceptable if they provide a basis for the f 6ndings requisite to the issuance or continuance of a permit or Copies of issued guides may be purchased from the Government license by the Commission. Pranting Office at the current GPO price. Information on current GPO prices may be obtained by contacting the Superintendent of This guide was issued af terconsideration of comments received from Documents. U.S. Government Printing Office, Post Of fice Box the public. Comments and suggestions for improvements in these 37082 Washington, DC 20033 7082, telephone (202)275-2060 or guides are encouraged at all times, and guides will be revised, as (202)275 2171, appropriate, to accommodate comments and to reflect new inforrna-tion or experience.

Written comments may be submitted to the Rules and Procedures Inf ormation Service on a stand 6ng order basis. Detalis on this Branch, ORR ADM, U.S. Nuclear R eg ulat ory Commission, serv 6ce may be obtained by writing NTIS, 5286 Rort Royal Hoad, Washington, Od 205%% Springfleid, V A 223 61.

8712040456 871130 PDR REG 9D 05.062 R PDR

Table 1 Summary of Reporting Requirements l

Required Reports Description of Safeguards Event Telephone report within I hour followed by a written 1. Loss of shipment of SNM or spent fuel.

report within 30 days

2. Recovery or accounting oflost shipment of SNM or spent fuel.

3. Threatened, attempted, or actual:

a. Theft or unlawful diversion of SNM,

b. Significant physical damage to a reactor or facility or carrier possessing SSNM,

c. Unauthorized interruption of normal operations at a power reactor.

4 Actual entry of unauthorized personinto a PA, M AA, CAA, VA, or transport.

5. Uncompensated failure, degradation, or discovered vulnerability in a safeguards system that could allow unauthorized or undetected access to a PA, MAA, CAA, VA, or transport.

6. Actual or attempted introduction of contraband into a PA, MAA, VA, or transport.

Safeguards event log submitted every 3 months 1. Compensated failure, degradation, or discovered vulnerability in a safeguards system that if uncom-pensated could have allowed unauthorized or undetected access to a PA, MAA, CAA, VA, or transport.

2. Any other threatened, attempted, or committed act not previously defined b) Appendix G of 10 CFR Part 73 that has the potential for reducing the effectiveness of the safeguards system below that committed to in a licensed physical security or contingency plan or the actual condition of such reduction in effectiveness.

PA = protected area MAA = material access area CAA = controlled access area VA = vital area SNM = special nuclear material SSNM = strategic special nuclear material O

5.62-2

i strategic special nuclear material (SSNM) and subject to To clarify, safeguards system failures include not only paragraph 73.67(d) are subject to the provisions of piira- mechanical or electrical system failures but also improper graph 73.7)(b) for events described in paragraphs 1(a)(2), security procedures or personnel practices. Discovered 1(a)(3),1(b), and 1(c) of Appendix G to Part 73. Licensees vulnerabilities include incidents in which the security subject to the provisions of 73.20,73.37,73.50,73.55, system has not failed, but some flaw in the security system

or 73.60 are subject to the provisions of paragraph 73.71(b) that had existed without being noticed has been discovered.

I for events described in paragraph 1(d) of Appendix G to

{ Part 73. 2.2 Examples of Safeguards Events To Be Reported i Within 1 Ilour

! Licensees subject to the provisions of { 73.20,73.37, j 73.50, 73.55. 73.60, rr each licensee possessing SSNM and The following are examples of events that should be

subject to paragraph 73.67(d) are subject to the provisions reported to the NRC within I hour because of their I of paragraph 73.7)(;). potential to endanger public health and safety or national security. This list should not be considered all-inclusive, j 2. REPORTABLE EVENTS The applicable regulation is cited for each event, and compensatory measures are discussed if appropriate.

2.1 Safeguards Events To Be Reported Within I liour

1. Credible bomb or extortion threats, in addition Paragraphs 73.7)(a) and (b) require certain events to to the initial telephone report, a telephone report of the be reported within I hour of discovery. Events under results of a bomb search should be made within I hour of paragraph 73.71(a) involve incidents in which theft, loss, completion of the search. Unsubstantiated threats need or diversion of a shipment of special nuclear material not be reported immediately unless a specific organization (SNM) or spent fuel has occurred or is believed to have or group claims responsibility or the threat is one of a occurred. A written report should be submitted to the pattern of harassing threats; in these cases, the threat NRC within 30 days on each event that is reported within must be reported within I hour. (Paragraph 1(a)(1), (2),

I hour. Safeguards events reportable under para- or (3) of Appendix G) There are no compensatory measures graph 73.71(b) and described in Appendix G to 10 CFR that would preclude the reporting of a substantiated threat Part 73 include: within I hour. If a threat cannot be substantiated (no organization or group identified, negative search results,

1. Acts, attempts, or threats to commit: and no additional evidence other than the threat message),

the event need only be logged. (Also see number 13 in

1. (a) Theft or unlawful diversion of SNM or spent Section 2.4 of this guide.)

fuel;

2. Discovery of a criminal act involving individuals (b) Significant physical damage to a power reactor, granted unescorted protected area or vital area access to any facility possessing SSNM or such facil- that, in the judgment of the licensee, adversely affects ity's equipment, to the carrier equipment radiological safety in licensed activities or facility opera-transporting nuclear fuel or spent nuclear fuel, tions (e.g., felonious acts, discovery of a conspiracy to or to the nuclear fuel or spent nuclear fuel a bomb the facility or disturb its vital components, vandalism facility or carrier possesses; of vital equipment, reasonable suspicion of illegal sale, use, possession, or introduction of a controlled substance (c) Interruption of normal operation of a licensed onsite). (Paragraph I(a)(2) or (3) of Appendix G) Because nuclear power reactor through the unauthor- of the serious nature of such an event, discovery of the ized use of or tampering with its machinery, event should be reported within I hour even if the indi-components, or controls, including the security vidual's unescorted access authorization is cancelled. (Also system. see number 3 in this section.)

2. Any actual entry of an unauthorized person into a 3. Discovery of a criminal act involving a person granted pr otected area, material access area, controlled unescorted protected area or vital area access if the act has access area, vital area, or transport equipment. the potential for adversely affecting the public health and safety, e.g., illegal use of a controlled substance offsite by a

3. Any uncompensated failure, degradation, or dis- reactor control room operator. (Paragraph I(a)(2) or (3) of covered vulnerability in a safeguards system that Appendix G) Licensees should exercise judgment in deter-could allow unauthorized or undetected access to a mining the deportability of criminal acts conducted offsite.

protected area, material access area, controlled access Only those acts with the potential for affecting the radio-area, vital area, or carrier transporting nuclear fuel, logical safety of licensed activities need be reported.

spent fuel, or formula quantities of SSNM. Criteria that can be used to judge deportability of these types of events include (1) the event indicates a failure in

4. Any actual or attempted introduction of contra- program design or implementation, (2) the person involved D band into a protected area, material access area, vital area, or transport equipment.

has safety-related responsibilities, or (3) the event is receiv-ing media attention. Positive drug screens should be 5.62-3

validated prior to determining deportability to the NRC. If 10. Civil disturbance near the plant site that may the event is properly compensated, e.g., the program failure pose a threat to the facility. (Paragraph 1(a)(2) or (3) is corrected or the individual's unescorted access is of Appendix G) suspended, then the event need only be logged.

I 1. Confirmed tampering of suspicious origin with

4. Discovery of theft or loss of classified documents safety or security equipment. (Paragraph 1(a)(1), (2), or pertaining to facility or transport safeguards. (Paragraph (3) of Appendix G) 1(a) of Appendix G) (Note: This is also reportable under

@ 95.57 of 10 CFR Part 95.) This type of event is consid- 12. An assault on a power reactor, facility, or trans-cred a credible threat to the proper safeguarding of a port possessing or transporting SSNM regardless of whether facility or transport. By the nature of this event, its dis- perimeter penetration is achiesed. (Paragraph 1(a)(1), (2),

covery can occur only after a significant degradation or (3) of Appendix G) of the safeguards system designed to protect the classified documents. No measure can adequately compensate for 13. Confirmed intrusions by unauthorized indi-l such an event, and events of this type should always be viduals into the protected area, material access area, con-reported within I hour of discovery. After the discovery, trolled access area, vital area, or carrier transporting the licensee should endeavor to locate the missing or formula quantities of SSNM. (Paragraph 1(b) of Appen-stolen document, take measures to help ensure the event dix G) Measures should be taken to preclude the recurrence is not repeated, and take whatever steps are possible to of such events. Smce any compensatory measures for such minimize the consequences of the event. an event would be after the fact of a serious safeguards degradation, there are no compensatory measures that

5. Fire or explosion of suspicious or unknown origin would preclude reporting such an event within I hour of within the isolation zone, protected area, material access discovery. The violation of licensee-established work rules area, or vital area. (Note: Events reportable under (e.g., area zoning) within an area by an authorized indi-

@ @ 50.72 or 50.73 do not require duplicate reports under vidual need not be reported or logged as a safeguards event.

@ 73.71.) (Paragraphs 1(a)(1), (2), (3), or 1(d) of Appendix (Also see number 11 in Section 2.4.)

G) If the origin of a fire or explosion can be determined within I hour to be nonsuspicious and the facility sustains 14. Uncompensated suspension of safeguards controls E no significant damage, the event is not considered a security during either radiological or nonradiological emergencies gf,,

threat to the facility and need not be reported or logged. that could allow undetected or unauthorized access. (Note: M. M i (Also see number 4 in Section 2.5.) Events reportable under @ 50.72 or 50.73 do not require duplicate reports under 73.71.) (Paragraph 1(c) of

6. Discovery of a suspicious vehicle following a licensed Appendix G) Section 5.3," Controls that Can Be Suspended carrier transporting formula quantities of SSNM. (Paragraph During an Emergency," of Regulatory Guide 5.65, " Vital I(a)(1) of Appendix G) In this situation, armed escorts or Area Access Controls, Protection of Physical Security other responsible personnel should determine whether or Equipment, and Key and Lock Controls," describes safe-not a threat exists and assess the extent of the threat, if guards measures that may be suspended during nonradio-any. If a threat exists, it should be reported to the NRC logical emergencies.

within I hour of confirmation and the provisions of para-graph 73.26(e) should be followed. If no threat exists, the event need not be reported or logged. 15. Discovery of intentionally falsified identification badges or key cards. (Paragraph 1(a) of Appendix G) This

7. Mechanical breakdown of transport vehicle carrying event is considered a safeguards threat to the facility and formula quantities of SSNM. (Paragraphs 1(a)(1), (2) of should always be reported within i hour of discovery.

Appendix G) Since it is difficult to readily determine if a Measures should be taken immediately to cancel the badges mechanical breakdown is random or intentional, and or key cards from the access system and to determine to because of the strategic significance of the material, what extent the badges or key cards have been used.

mechanical breakdowns of transports carrying formula quantities of SSNM should always be reported to the NRC within I hour of discovery. 16. Discovery of uncompensated and unaccounted for, lost, or stolen key cards, l.D. card blanks, keys, or

8. Complete loss of offsite communications. (Para- any access device that could allow unauthorized or graph 1(a)(2) or (3) of Appendix G)If possible, the licensee undetected access to protected areas, material access should report the complete loss of communications from areas, controlled access areas, or vital areas. (Paragraph the site within I hour or immediately after restoration of f(c) of Appendix G) Such events need not be reported communications. If communications from the site are lost within I hour if measures are taken within 10 minutes of and cannot be restored within ! hour, the licensee should the discovery of the loss to preclude the use of the lost or use communications located offsite to notify the NRC. stolen device for gaining access to a controlled area and to ensure that the lost or stolen device has not been used

9. Mass demonstration at plant site that may pose a in an unauthorized manner prior to completion of actions threat to the facility. (Paragraph 1(a)(2) or (3) of Appen- to prevent unauthorized use of the device. (Also see dix G) number 6 in Section 2.4.)

5.62-4

17. Compromise of safeguards information (including are expected to discover this type of event upon occur-loss or thef t) that would significantly assist a personin an act rence. (Also see number 3 in Section 2.4.)

of radiological sabotage or theft of SNM. (Paragraph I(a) of Appendix G) There is no measure that would adequately 22. Loss of alarm capability or locking mechanism compensate a compromise of safeguards information once on a material access area or vital area portal. (Paragraph the event has occurred. A licensee should always report this 1(c) of Appendix G) A bolt-position alarm capability is type of event within I hour of discovery, and follow-up not a pwper compensatory measure for loss of a balanced.

measurcs similar to those for theft orloss of a classified docu- magnetic alarm because it is not tamper resistant. Proper ment should be taken. (Also see number 4 in this section.) compensation for either of these events means immediate (within 10 minutes of discovery) posting of a dedicated

18. Uncompensated loss of the ability to monitor or observer for loss of an alarm or postir" an armed member remotely assess protected area alarms through loss of both of the security force forloss of a lock. The posted observer central and secondary alarm stations. (Paragraph f(c) of or guard should have appropriate communications equip-Appendix G) If the event involves an outage of the alarms, ment.1 In addition, a thorough search of the affected area closed circuit television, or security computers, the event should be initiated immediately and completed as soon as is considered properly compensated if the original capabil- practicable. Licensees are expected to discover this type of ity is restored within 10 minutes of discovery of the event event upon occurrence. (Also see number 8 in Section 2.4.)

or if dedicated observers with appropriate communica-tions equipment are in place within 10 minutes of the 23. Discovery of the actual or attempted introduc-discovery to provide total observation of each area.1 tion into or possession within the protected area, material Licensees are expected to discover this type of event upon access area, or vital area of unauthorized weapons, explo-occurrence. If immediate restoration of system capability is sives, or incendiary devices. (Paragrap5 ((d) of Appendix G) provided by activating secondary computers, the loss of There are no compensatory measure Rat would preclude backup capabihty need not be reported within I hour. reporting this event within I hour. If an actualintroduction f (Also see number 10 in Section 2.4.) of contraband is made, steps should be taken to correct the vulnerability that allowed the introduction. The discovery

19. Unavailability of a minimum number of security of vehicular emergency equipment such as safety fl9tes personnel or an actual or imminent strike by the security during entrance searches need not be reported or logged.

force. (Paragraph 1(c) of Appendix G) If an unexpected (Also see number 5 in this section.)

unavailability o.f a minimum number of security personnel occurs, procedures pre-approved by the NRC may be used; 24. Loss of security weapon at the site, (Paragraph or "on call" guards or trained management, supervisory, or 1(a)(3) of Appendix G) operations personnel available within 10 minutes may be used to supplement the on-duty security force. If minimum 2.3 Safeguards Events To Be Reported and Submitted requirements cannot be met, the event should be reported Quarterly in a Log within I hour of discovery.

The following safeguards events reportable under

20. Uncompensated loss of all ac power supply to paragraph 73.71(c) need only be logged within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> security systems that could allow unauthorized or unde- of their discovery and submitted quarterly to the NRC:

tected access to a protected area, material access area, controlled access area, or vital area. (Parigraph I(c) of 1. Any failure or degradation of a safeguards system Apperidix G) If the security system integrity can be main- or discovered vulnerability in a system that could tained by standby power, the event is considered properly have allowed unauthorized or undetected access to a compensated and need only be logged. Ilowever,if standby protected area, material access area, controlled power fails prior to restoration of ac power, the event access area, vital area, or transport equipment if should be reported within I hour of loss of standby power. compensatory measures had not been established.

Licensees are expected to discover this type of event upon (Logging is not required for preplanned situations occurrence. ( Also see number 7 in Section 2.4.) that require compensatory measures, such as special outage work, equipment relocation, exercises and

21. Uncompensated loss of ability to detect within a drills, and other situations that are not the result of ngle intrusien detection system zone. (Paragraph 1(c) of a safeguards system failure.)

s.ppendix G) Proper compensation for this event means immediate deployment (within 10 minutes of discovery) 2. Any other threatened, attempted, or committed act of back-up intrusion detection equipment or posting a not previously defined in Appendix G that has the dedicated observer with a view of the entire arec and potential for reducing the effectiveness of the safe-capability to communicate with alarm stations.3 Licensees guards system below that committed to in a licensed physical security or contingency plan or the actual I

Posting personnel as a compensato measure in ties that the personnel are capabic of performing the ost or degra d function, when they cannot perform that function, such as when they are With respect to the proper compensation of an event, asleep, there is an uncompensated loss that must be reported within compensatory measures need to be implemented promptly I hour of discovery. Preplanned com nsatory measures are nortnally described in NRC-approved safeguar s plans. to be effective. For example, measures used to compensate 5.62-5

for a design flaw or vulnerability in a safeguards barrier that immediately and completed as soon as practicable.

has existed for some period of time and that could allow Licensees are expected to discover this type of event upon unauthorized or undetected access are not considered occurrence.

effective if implemented more than 10 minutes after the flaw or vulnerability occurs; such events require immediate 3. Properly compensated alarm failures. (Paragraph reporting. Prompt implementation will minimize any period I!(a) of Appendix G) For this event, proper compensation of degradation that may exist between the occurrence and means deployment of back-up alarm equipment (a bolt-proper compensation after discovery of certain events. position alarm capability is not considered back-up alarm Proper compensation after discovery of an event does not equipment because it is not tamper-resistant) or posting a relieve the licensee from the responsibility for taking dedicated observer within 10 minutes of discovery.8 The long-term corrective action, nor does it relieve the licensee dedicated observer should have appropriate communica-from possible enforcement action by the NRC for non- tions equipment and should be able to observe the entire compliance during the periods of safeguards system affected area of the portal in addition, a thorough search degradation. flowever, licensees are not ordinarily cited for of the affected area should be initiated immediately and violations resulting from matters not within their control, completed as soon as practicable. Licensees are expected to such as equipment failures that occurred despite reasonable discover this type of event upon occurrence. ( Also see licensee quality assurance measures, testing and mainte- number 21 in Section 2.2.)

nance programs, or management controls. (See 10 CFR Part 2, Appendix C, paragraph V.A.) 4. Properly compensated closed circuit relevision failure in a single zone while the intrusion detection system False alarms (those generated without any apparent remains operational. (Paragraph II(a) of Appendix G) cause) and nuisance alarms (those generated by an identi. Properly compensated means providing other assessment fled input that does not represent a safeguards threat) capability, such as posting a dedicated observer with generally need not be reported or logged. Ilowever,if false communications equipment to assess the entire zone or nuisance alarms are so frequent that the effectiveness of within 10 minutes of discovery of the failure.3 Licensees the alarm system is degraded or a pattern of false or nui- are expected to discover this type of event upon occurrence.

sance alarms emerges, the licensee should take corrective action and note the degraded status and compensatory 5. Properly compensated failute or degradation of a measures taken in the safeguards event log. single perimeter lighting zone if the intrusion detection system remains operational. (Paragraph II(a) of Appen-2.4 Examples of Safeguards Events To Be Reported dix G) Measures to properly compensate for failure or and Submitted Quarterly in a Log degradation of a lighting zone must be implemented witidn 10 minutes of discovery and may include (1) using standby The following are examples of events that are less power, (2) using low-light-level surveillance devices, significant than those reportable within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, and accord- (3) using portable lighting systems, or (4) posting dedicated ing to the rule are required to be logged within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> observers with appropnate communications equipment to and submitted quarterly to the NRC. Thislist should not be provide an equivalent level of protection.

considered all-inclusive. The applicable regulation is cited for each event, and compensatory measures are discussed 6. Properly compensated accidental removal offsite where appropriate. or loss of badge by employee. (Paragraph II(a) of Appen-dix G) For this event, proper compensation is cancelling

1. Properly compensated security computer failures. the badge from the access control system within 10 minutes (Paragraph II(a) of Appendix G) Properly compensated of onsite personnel discovering that the badge is missing.

means that within 10 minutes of the discovery of the Measures must be taken to be sure the badge has not been failure the system is restored to operation, the backup used in an unauthorized manner while it has been missing.

system is operational, or other resources (e.g., security (Also see number 16 in Section 2.2.)

personnel with appropriate communications equipment) are posted to provide an equivalent level of protection. In all cases, a thorough search of all areas where alarms or 7. Properly compensated loss of the ac power supply access controls may have been compromised by the failure for the entire intrusion detection system that, if uncom-should be initiated immediately and completed as soon as pensated, would allow unauthorized or undetected access.

practicable. Licensees are expected to discover this type (Paragraph II(a) of Appendix G) Proper compensation for of event upon occurrence.

this event is immediately available emergency power through an uninterruptible power source such as a battery

2. Properly compensated vital area card reader failures.

supported by a generator. If back-up power is not available, (Paragraph ll(a) of Appendix G) For this event, proper security personnel with communications equipment should compensation means posting appropriate personnel (i.e..

be posted within 10 minutes of discovery; however, this armed guard if door is unlocked, dedicated observer if door action is not considered proper compensation for the event remains locked but access is required) within 10 minutes of and does not excuse a licensee from repnrting the event discovery.3 The appropriate personnel must have a current within I hour. Licensees are expected to dacover this type access list and communications capability to alarm stations. of event upon occurrence. (Also see number 20 in Section A thorough search of the affected area must be initiated 2.2.)

5.62-6

8. Properly compensated loss of either alarm or locking 3. Infrequent nuisance alarms causrd by mechanical mechanism on a material access area or a vital area portal. or environmental problems and false alarms that do not (Paragraph II(a) of Appendix G) A bolt-position alarm exceed the rates committed to in the licensee's approved capability is not considered a proper compensatory measure security plan or do not degrade alarm system effectiveness, because it is not tamper resistant. Proper compensation for this event is immediate (within 10 minutes of discovery) 4. When the origin of a fire or explosion can be deter-posting of a dedicated observer for a loss of alarm or an mined within I hour to be nonsuspicious and the facility armed member of the security force forloss of a lock.1 The sustains no significant damage.

posted personnel should have appropriate communications equipment. In addition, a thorough search of the affected 3. PROCEDURES area should be initiated immediately and completed as soon as practicable. Licensees are expected to discover this type The determination for reporting an event under para-of event upon occurrence. (Also see number 23 in Section graphs 73.71(a), (b), and (c) should be made by onsite

2. 2.) security management or their equivalent. Ilowever, dis-covery of such an event is not limited to members of

9. Security computer failures that may not enable the security organization. It is recommended that all unauthorized or undetected access. (Paragraph II(b) of regular site employees receive security orientation by the Appendix G) security organization to foster an awareness of site security and to be briefed on their responsibility to immediately

10. Loss of the capability of a single alarm station notify site security of safeguards anomabes.

to monitor or remotely assess alarms but monitoring or assessment capability remains in other stations. (Paragraph Events of a dual nature (i.e., having both safety and II(b) of Appendix G)(Also see number 18 in Section 2.2.) safeguards implications and subject to the requirernents of

( $0.72, 50.73, and 73.71) do not require duplicate

11. Tailgating by a licensee or contractor employee to reports under the requirements of 73.71. If a power gain access to an area to which he or she is authorized reactor licensee reports an event that is reportable in access. (Paragraph II(b) of Appendix G) (Also see number accordance with both 50.73 and 73.71, the proce-13 in Section 2.2.) dures described in 50.73 (i.e., submittal of a licensee event report (LER)) rnust be followed. The procedures

12. For shipments of formula quantities of SSNM, contained in NUREG-1022, " Licensee Event Report intra <onvoy communications ability is lost, but ability to Systern,"2 describe how to indicate that an LER meets communicate with movement control center remains. multiple reporting requiremen's. When submitting reports (Paragraph II(b) of Appendix G) of events reportable solely under the provisions of 73.71, power reactor licensees should use LER Form 366; all other

13. Unsubstantiated bomb or extortion threat. Licensees should write a letter, if the written report contains (Paragraph II(b) of Appendix G) An unsubstantiated restricted data, e.g., unclassified safeguards information, the bomb or extortion threat is a threat in which no specific report must be appropriately marked. If NRC Form 366 or organization or group claims responsibility, the search 366A is used, restricted data may be included only in the result is negative, and no evidence is available other than text section (Item 17 of the form). Restricted data should the threat message, if a threat is one of a pattern of not be included in the abstract section (item 16) or any harassing, even if unsubstantiated, it should be reported other section of the form other than the text section. In within I hour. addition, the text should clearly indicate the information that is restricted. Finally, the requirements of paragraph 2.5 Events Not Required To Be Logged or Reported 73.21(g) must be met when transmitting written pro-prietary information.

Certain failures of the safeguards system that do not and could not reduce the effectiveness of the system have It is recognized that not all items of NRC Form 366 little or no safeguards significance; events having little may apply when safeguards events are reported. Power or no safeguards significance need not be reported or reactor licensees should be sure that all the information logged. The following are examples of events that are not needed by the NRC for analysis and evaluation, as described required to be logged or reported. This list should not be in section 3.2 of this guide, is included on the form, considered all-inclusive, whether under a specific item or in the text section.

1. Cuts made by authorized maintenance personnel Procedures for the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> report, the 30-day followup through a vital area barrier for a legitimate reason (e.g., report, and the quarterly log are discussed in the following to install pipe)if prior approval, coordination with security, sections.

and proper compensatory measures have been established.

2. A person attempting to climb a protected area 2 F. J. Hebdon, " Licensee Event R t System U.S. N uclear fence if the person is obviously a child. Regulatory Commission, NUREG 1022, ptember t h"83.

5.62-7

3.1 1-ilour Reports . 5. Type of security force onsite (proprietary or contract).

When a licensee, licensee employee, or contract employee discovers an event reportable under paragraph 73.71(a) or 6. Number and type of personnel involved, e.g.,

(b), telephone notification to the NRC Operations Center contractors, security, visitors, NRC personnel, listed in Appendix A to 10 CFR Part 73 should be made other (specify).

within I hour of the discovery. Telephone notification should be made via the Emergency Notification System 7. Method of discovery of incident, e.g., routine (ENS)if the licensee is party to that system. If the ENS is inspection, test, maintenance, alarm, chance, inoperative or unavailable, a commercial telephone should informant, communicated threat, unusual circum-be used to ensure that the required notification is received stances (give details).

by the NRC Operations Center within I hour of discovery of the event. The commercial telephone number that may 8. Procedural errors involved,if applicable, be used to contact the NRC Operations Center is (301) 951-0550. Other methods that may be used to ensure 9. Immediate actions taken in response to eveut.

notification within I hour include telegram, mailgram, or facsimile. Telegrams and mailgrams should be hand delivered 10. Corrective actions taken or planned.

to the Operations Officer at the NRC Operations Center, Maryland National Bank Building, 7735 Old Georgetown 11. Local, State, or Federal law enforcement agencies Road, Bethesda, Maryland 20814. For information con- contacted.

cerning facsimiles, telephone the NRC Operations Center at (301) 492-8893. If pertinent information or errors are 12. Description of media interest and press release.

uncovered after the initial telephone report but prior to submittal of the written report, the licensee should notify 13. Indication of previous similar events.

the NRC Operations Center of the information or error by {

telephone. 14. Knowledgeable contact. I Under the provisions of paragraph 73.71(a), the licensee For security system failures, provide the following in (or agent) should also notify the NRC Operations Center by addition to items 1 through 14:

telephone within I hour of the recovery of or accounting for a shipment with information on the materiallocated, 15. Description of failed or malfunctioned equipment known reason for loss. etc. (including manufacturer and model number).

Telephone reports made pursuant to 73.71 may be 16. Apparent cause of each component or system transmitted over unprotected lines as permitted by the failure. (For uncompensated security computer exemption in paragraph 73.21(g)(3). failures, state the reason the event could not be compensated and list specific components affected, 3.2 30-Day Followup Written Reports e.g., central processor, peripheral / terminal equip-ment, software.)

A followup written report must be submitted within 30 days of a 1-hour report. Power reactor licensees should 17. Status of the equipment prior to the event (e.g.,

use the Licensee Event Report form, NRC Form 366, in operating, being maintained, made secure) and submitting their reports; all other licensees should use a compensatory measures in place.

letter format. For all licensees, the information described below is sufficient for NRC analysis and evaluation and 18. Secondary functions affected (for multiple-function should be included in the report as a minimum. Reports components).

of events must be legible and reproducible and should include the following: 19. Effect on plant safety.

1. Date and time of event (start and end time). 20. Unusual conditions that may have contributed to failure, e.g., environmental extremes.

2. Location of actual or threatened event in a pro-tected area, material access area, controlled For threat-related incidents, provide the following in access area, vital area, or other (specify area). addition to items 1 through 14:

3. For power reactors, the operating phase, e.g., 21. Number of perpetrators.

shut-down, operating.

22. Type of threat, e.g., bomb, extortion.

4. Safety systems affected or threatened, directly or indirectly. 23. Means of communication, e.g., letter, telephone.

5.62-8

24. Text of threat. 1. Date and time of the event;

25. Mode of operation. 2. Brief (one-line) description of the event;

26. Clear photocopy of threat letter and accompanying 3. Brief (one-line) description of compensatory or envelope if applicable. corrective actions taken; Licensees should submit one copy of each written 4. Area affected, e.g., vital area, protected area, report to the U.S. Nuclear Regulatory Commission, owner controlled, transport; and Document Control Desk, Washington, DC 20555, and one copy to the appropriate Regional Office listed in Appen- 5. Ilow detected, e. g. , alarm, routine inspections, dix A to 10 CFR Part 73. If pertinent information or patrol, informants.

errors are uncovered after the initial telephone report or the written report is submitted, the licensee should notify Every 3 months, the licensee is required to submit one the NRC Operations Center by telephone of the informa- copy of all log entries not previously submitted to the tion or errors. if the information is uncovered after the NRC Document Control Desk. The log entries need not be written report has been submitted, the licensee should typed as long as they are legible; a photocopy is accept-submit a complete revised written report with revisions able. Licensees are permitted a 30-day grace period for indicated to the Document Control Desk and the Regional alllog submittals.

Office. The revised report should be complete and should not contain only the supplementary or revised information.

Events of a similar nature that are logged and sub-3.3 Maintenance and Quarterly Submittal of Log mitted to the NRC under paragraph 73.71(c) may be consolidated into a single log entry if they occur repeatedly Events reportable under paragraph 73.71(c) only need within the quarterly submittal period. The date and time to be logged. In maintaining the log, it is recommended should be specified for each occurrence of the event. For that the licensee log the information as received and then example,if thereis a repeated occurrence of a compensated summarize and update the log entry when the event computer failure and each failure is the result of the same terminates. Ilowever, licensees are required by paragraph problem, only one log entry providing the details of 1 5 73.71(c) to log entries witltin 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the discovery of through 5 above need be made. Ilowever, the date, time, the event. Since the licensee would immediately investigate and duration of the event should be recorded in the log all events that threatened nuclear activities or lessened the for each occurrence.

effectiveness of the security system, the details would generally be available when the entry was made in the log. Each log must be ietained for 3 years after the last Log entries should include as a minimum; entry to that log.

5.62-9

APPENDIX A GLOSSARY NOTE: This glossary only applies to the requirements of 73.71 of 10 CFR Part 73.

A ny failure, degradation, or discovered vulnerability: The Nuisance alarm: An alarm generated by an identified cessation of proper functioning or performance of equip- input that does not represent a safeguards threat. Nuisance ment, personnel, or procedures that compose the physical alarms may be caused by environmental (rain, sleet, snow, protection program necessary to meet Part 73 require- lightning) or mechanical (natural objects such as animals ments, or a discovered defect in such equipment, personnel, or tall grass) factors.

or procedures that degrades function or performance.

Properly compensated: Measures, including backup equip-Credible threat: A threat should be considered credible ment, additional security personnel, and specific proce-when (1) physical evidence supporting the threat exists, dures, taken to ensure that the effectiveness of the security (2) information independent from the actual threat system is not reduced by failure or other contingencies message exists that supports the threat, or (3) a specific affecting the operation of the security-related equipment group or organization claims responsibility for the threat. or structures. Preplanned compensatory measures are normally described in NRC-approved safeguards plans.

Dedicated observer: A person, not necessarily a member i

of the security force, posted as a temporary compensatory Safeguards event: Any incident representing an attempted, l measure for a degraded assessment or detection capability threatened, or actual breach of the safeguards system or both. While performing this function, duties must be or reduction of the operational effectiveness of that limited to detection and assessment. As a minimum, the system.

person must be able to view the entire area affected by the degradation and must be able to communicate with Safeguards Event Log: A compilation of log entries for the the central alarm station. events described in Section II of Appendix G to 10 CFR 1 Part 73. Entries must include the date and time of the Diversion of SNM: Unauthorized movement of SNM by indi- event, a description of the event, and any action taken.

viduals authorized access to or control over the material. Repeated events may be consolidated into a single log entry with the date, tine, and duration of each event recorded False alarm : An alarm generated without an apparent for each occurrence. The ongoing safeguards event log may cause. Investigation discloses no evidence of a valid alarm be maintained in more than one location onsite. The log condition, including tampering, no nuisance alarm condi- may be typed or handwritten as long as it is legible and tions, and no equipment malfunction. reproducible. Entries in a safeguards event log submitted to the NRC need not be in time-sequential order.

Interruption of normaloperation: The cessation of normal operation that, if accomplished, would result in sub- Safeguards system: The equipment, personnel, and stantial economic harm or cost to the licensee. procedures that make up the physical protection program necessary to meet Part 73 requirements.

Loss of SNM; (1) A failure to measure or account for material by the material control and accounting system approved for the facility when the material is authorized to repossessed Significant physical damage: Physical damage to the by the licensee and is not confirmed stolen or diverted or (2) extent that the facility, equipment, transport, or fuel an accidental (i.e., unplanned) offsite release or dispersal of cannot perform its normal function (applies to a power SNM known orsuspected to be 10 timesgreater than normal reactor, a facility possessing SSNM or its equipment, operating losses for the time in question, whether or not the carrier equipment transporting nuclear fuel or spent release is measured. The term loss implies that a search has nuclear fuel, or to the nuclear fuel or spent nuclear fuel a been conducted to confirm the materialis missing. For fixed facility or carrier possesses).

sites, this search should be conducted within the 1-hour time for reporting.

Tampering: When used in connection with Appendix G to

" Lost" versus "unaccountedfor" in regard to transporta- 10 CFR Part 73, altering for improper purposes or in an tion of morerial: The term " lost" covers material that is no improper manner, longer in the possession of the party authorized to possess it during a specific time period, and a search for the mate- Theft of SNM: The unauthorized taking of SNM for rial has verified the loss. " Unaccounted for" refers to unauthorized use.

material in transit that has not arrived at its delivery point 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or more after the estimated arrival time; however, a Unauthori cd person: Any unescorted person in an area search has not confirmed the material to be lost, to which the person is not authorized unescorted access.

5.62-10

APPENDIX B SAMPLE LOG ENTRIES Safeguards events reportable under paragraph 73.71(c) of mitted to the NRC every 3 months does not have to be 10 CFR Part 73 need only be logged within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of typewritten, but it rnust be legible. The sample log items their discovery. The copy of the log (photocopy) sub- presented here should not be considered all-inclusive.

LOG ENTRY EVENT DATE/ TIME DATE/ TIME EVENT RESPONSE

1. 1-8-87/0140 1-8-87/0130 CAS operator received telephone bomb Area search initiated at 0135 hrs, threat from unidentified male. Bomb completed 0140 hrs, nothing reported near diesel generator. found.

2. 1-8-87/1245 1-8-87/1043 Delivery truck significantly damaged PA Guard posted at 1050 hrs, relieving fence in zone No. 4. Discovered at 1047 patrol (immediate comp), PA

{ by security patrol, no PA or VA alarms searched.

received.

g5

(

3. 1 9-87/1605 1-9-87/1433 Card reader failure at VA portal No. 2. At 1440 hrs, posted guard with current access list. System failure corrected and opera-tional at 1600 hrs.

4. 1-9-87/1815 1-9-87/1730 1.D. badge No. 342 lost onsite. Badge cancelled 1732 hrs. Badge found on employee'sjacket at 1745 hrs.

5. 1-9-87/2055 1-9-87/2025 Security system failure, single CPU Determined caused by electrical outage, storm / power surge. System back on line at 2028 hrs. All VA portals confirmed locked and alarmed by security.

6. 1 10-87/1410 1 10-87/1405 Fence repaired. (See Entry No. 2.) Compensatory post discontinued at 1405.

7. 1-12-87/1100 1 12-87/0812 Perimeter fence alarms received Area searched by security patrol.

1-12-87/0815 zone No. 4. No apparent cause for alarms.

1 12-87/0817 Security posted after third alarm 1-12-87/0819 and maintenance called to check 1-12-87/0823 system. System function verified through test each occurrence. All actions completed 1035.

8. 1-12-87/1610 1-12-87/1443 CCTV failure, perimeter zone No. 2 Dedicated observer in place 1450 (IDS operational). hrs. No alarms received. Camera replaced and operational at 1610.

9. 1-12-87/2015 1-12-87/2007 See No. f above. Same as No. 5 above. System on-line at 2011 hrs.

10. 1-12-87/2350 1-12-87/2230 Latch alarm received on VA portal Guard posted at 2238. Area No. 6. Responder found door slightly searched, no abnormalities found.

aj ar. Maintenance request initiated at O 2315.

.u. s.covcamment pathT1uc orriccoas7- 202 292 60271 5.62-11

VALUE/lMPACT STATEMENT A separate value/irnpact statement has not been for the proposed revisions to 73.71 and was made prepared for this regulatory guide. The guide was revised available in the NRC Public Document Room at the time to provide guidance on reporting physical secu ity events of publication (August 27, 1985-50 FR 34708). This in accordance with paragraphs 73.71(a) through (c) of regulatory analysis is also appropriate for this regulatory 10 CFR Part 73. A regulatory analysis was prepared guide.

1 UNITED STATES , inst etass man NUCLEAR REGULATORY COMMISSION POST ^o' 'S tS PAS WASHINGTON, D.C. 20555 PERMIT No, G 67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. $300 A ypg 1 10P11S11R g DIV 0F INFO SUP SVCS D O C U M E'lT CONTROL BPANCH DOCUMENT 042 CONTROL DESK WASHINGTON DC 20555 0

5.62-12 s _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ .

VALUE/ IMPACT STATEMENT A separate value/ impact statement has not been for the proposed revisions to @ 73.71 and was inade prepared for this regulatory guide. The guide was revised available in the NRC Public Document Room at the time to provide guidance on reporting physical security events of publication (August 27, 1985-50 FR 34708). This

, in accordance with paragraphs 73.71(a) through (c) of regulatory analysis is also appropriate for this regulatory l 10 CFR Part 73. A regulatory ar.alysis was prepared guide.

UNITED STATES rimst CLASS MAIL NUCLEAR REGULATORY COMMISSION POSTAGE & FEES PAID WASHINGTON, D.C. 20555 Pf RMIT No. G-47 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. 6300 A 19g 1 10P11S11R DIV 0F INFO SUP SVCS DOCUMENT CONTROL BPANCH UMENT CONTROL DESK WASHINGTON DC 20555 0

5.62-12

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _