ML20295A356

IMC 0609-App-E Significance Determination Process for Power Reactors

ML20295A356
Person / Time
Issue date:	04/02/2021
From:	Alonzo Richardson NRC/NSIR/DSO/SOSB
To:
Richardson, Alonzo
Shared Package
ML20295A354, ML21091A140	List:
References
CN 21-018
Download: ML20295A356 (7)

Text

NRC INSPECTION MANUAL NSIR/DSO INSPECTION MANUAL CHAPTER 0609, APPENDIX E SECURITY SIGNIFICANCE DETERMINATION PROCESS FOR POWER REACTORS 0609E-01 PURPOSE 01.01 Baseline Security Significance Determination Process. - The purpose of the Baseline Security Significance Determination Process (BSSDP) is to provide an objective means of evaluating findings related to common defense and security for activities licensed by the U.S.

Nuclear Regulatory Commission (NRC) as defined in Inspection Manual Chapter (IMC) 2201, Security Inspection Program for Operating Commercial Nuclear Power Reactors. The process also will be used to provide assurance that licensees safeguards systems can effectively protect against the design basis threat (DBT) based on defense-in-depth layers of protection as part of licensees commitments to NRC requirements.

01.02 Force-on-Force Significance Determination Process. - The purpose of the Force-on-Force Significance Determination Process (FOFSDP) is to provide an objective means of evaluating findings associated with marginal exercise performance and exercise failures in the implementation of licensees protective strategies. Other security-related findings identified during force-on-force (FOF) activities that are not directly related to FOF exercise outcomes will be evaluated using the BSSDP.

01.03 Construction Fitness-for-Duty Significance Determination Process. - The purpose of the Construction Fitness-for-Duty Significance Determination Process (CFFDSDP) is to provide an objective means by which NRC inspectors and management can assess the significance of fitness-for-duty (FFD) findings identified at facilities subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 26, Fitness for Duty Programs, for which a Limited Work Authorization or a Combined License has been issued authorizing construction activities. These inspection activities are associated with IMC 2200, Security Inspection Program for Construction, which, in part, provides assurance that construction activities are not adversely affected because of FFD issues.

01.04 Cyber Security Significance Determination Process for Power Reactors. - The purpose of the Cyber Security Significance Determination Process for Power Reactors (CSSDP) is to provide an objective means of evaluating findings relating to cyber security requirements for power reactors licensed by the NRC.

0609E-02 OBJECTIVES 02.01 The objective of the Physical Protection Cornerstone is to provide assurance that the safeguards systems and programs effectively protect against the DBT and the loss or theft of special nuclear materials. The attributes of this cornerstone are based on defense-in-depth strategies and are intended to provide protection against both internal and external threats. The NRC assesses licensee performance in this cornerstone by determining the significance of security-related issues and findings.

Issue Date: 04/02/21 1 0609 Appendix E

02.02 The BSSDP is the tool with which NRC inspectors will assess the risk or security significance of findings. This process consists of a deterministic, logic-flow chart that will allow individual findings to be categorized into one of the four response bands: GREENa finding of very low safety and security significance; WHITEa finding of low to moderate safety and security significance; YELLOWa finding of substantial safety and security significance; or REDa finding of high safety and security significance.

02.03 Under the security cornerstone, the Significance Determination Processes (SDPs) for operating power reactors addresses physical protection in two parts; Part I for the baseline inspection activities routinely conducted by the regional inspection staff, and Part II for FOF exercises routinely conducted by the Headquarters inspection staff.

02.04 The CFFDSDP for new reactors is identified in IMC 0609, Appendix E, Part III, and Construction Fitness for Duty Significance Determination Process for New Reactors.

Regional inspection staff members routinely conduct these inspections.

02.05 The CSSDP is identified in IMC 0609, Appendix E, Part IV, and Cyber Security Significance Determination Process for Power Reactors. The CSSDP addresses significance determination for cyber security inspection activities routinely conducted by Headquarters and Regional inspection staff.

0609E-03 APPLICABILITY The SDPs described in this manual chapter are applicable to inspection findings identified through the implementation of the NRCs inspection programs described in IMC 2201 and IMC 2200.

0609E-04 DEFINITIONS Applicable definitions can be found in the Definitions section of IMC 0611, Power Reactor Inspection Reports, and IMC 0613, Power Reactor Construction Inspection Reports.

0609E-05 RESPONSIBILITIES AND AUTHORITIES All NRC inspectors are required to assess the significance of inspection findings in accordance with the guidance provided in this manual chapter. General and specific responsibilities are listed below.

05.01 Director, Office of Nuclear Reactor Regulation.

a. Provides overall program direction for the reactor oversight process (ROP) and Construction Reactor Oversight Process (cROP).

b. Develops and directs the implementation of policies, programs, and procedures for regional application of the SDP in the evaluation of findings and issues associated with the ROP and cROP.

Issue Date: 04/02/21 2 0609 Appendix E

c. Assesses the effectiveness, uniformity, and completeness of regional implementation of the SDP.

05.02 Director, Office of Nuclear Security and Incident Response.

a. Provides overall program direction for the security cornerstones within the ROP and cROP.

b. Develops and directs the implementation of policies, programs, and procedures for regional application of the security SDPs in the evaluation of findings and issues associated with the security cornerstone relative to the ROP or cROP.

05.03 Director, Division of Security Operations.

a. Approves all SDPs for the security cornerstone within the ROP and cROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b. Provides oversight and representatives, as necessary, to support the Significance and Enforcement Review Panel (SERP) to ensure consistent and timely application of the process.

05.04 Director, Division of Physical and Cyber Security Policy

a. Approves all cyber security SDPs associated with the ROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b. Provides oversight and representatives, as necessary, to support the SERP to ensure consistent and timely application of the process.

05.05 Director, Division of Reactor Oversight

a. Approves all SDPs related to the ROP and directs the development of future SDPs and improvements through periodic revisions based on new risk insights and feedback from users.

b. Provides oversight and representatives, as necessary, to support the SERP to ensure consistent and timely application of the process.

05.06 Regional Administrators.

a. Provides program direction for management and implementation of SDPs to activities performed by the regional office.

b. Maintains overall responsibility for and application of regional resources, as necessary, to determine the significance of specific inspection findings in a timely manner using best available information consistent with the SDP-timeliness goal and associated SDP-timeliness metrics.

Issue Date: 04/02/21 3 0609 Appendix E

05.07 Director, Construction Project Office (e.g., Vogtle Project Office (VPO)).

a. Approves all SDPs related to the cROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b. Provides oversight and representatives as necessary to support the Significance and Enforcement Review Panel (SERP) in order to ensure consistent and timely application of the process.

05.08 Director, Division of Risk Assessment (DRA).

a. Provides support to the development of plant specific construction SDPs, specifically with regard to the assignment of systems and components to the risk importance axis of the construction SDP matrix.

b. Provides oversight and representatives as necessary to support the SERP in order to ensure consistent and timely application of the process.

05.09 Director, Division of Construction Oversight (DCO), Region II.

a. Provides program direction for management and implementation of the SDP to inspection activities performed by DCO staff.

b. Maintains overall responsibility for, and applies regional resources as necessary, to determine the significance of specific inspection findings in a timely manner, using best available information consistent with the SDP timeliness goal and associated SDP timeliness metrics.

05.10 Director, Office of Enforcement.

a. Ensures consistent application of the enforcement process to violations of NRC regulations with the appropriate focus on the significance of the finding.

b. Provides representatives, as necessary, to support the SERP to ensure consistent application of the enforcement process.

c. Coordinates with the Office of Nuclear Reactor Regulation (NRR) and the Office of Nuclear Security and Incident Response (NSIR), when necessary when revising agency documents used for communicating to the licensee about apparent violations and final determinations associated with the ROP or the cROP.

0609E-06 BACKGROUND Background information on the security SDP can be found in IMC 0308, Attachment 6, Basis Document for Security Cornerstone of the Reactor Oversight Process.

Issue Date: 04/02/21 4 0609 Appendix E

0609E-07 SDP DEVELOPMENT AND FEEDBACK PROCESS 07.01 SDP Development. The development of a new SDP or significant modification of an existing SDP should follow the general process used for original SDP development. This process should include the following general steps:

a. The draft of the SDP or the modification is subjected to internal NRC stakeholder review, including NRC regional input. Early external stakeholder input also may be solicited through public meetings, if appropriate.

b. NRC staff performs a feasibility review to assess the adequacy of the proposed SDP or changes. This review should specifically involve regional representation and should test the SDP with real (preferred) or hypothetical inspection finding examples. This review should determine if the proposed SDP or change is ready to be issued for appropriate stakeholder comment or for initial evaluation through field use by regional inspectors.

c. Upon reconciliation of stakeholder comments and initial user feedback, the NRC issues the SDP or change as a revision to this manual chapter.

d. The NRC provides appropriate training to its inspection staff.

07.02 SDP Feedback and Improvement. IMC 0801, Reactor Oversight Process Feedback Program, describes in detail the feedback process and feedback form used by NRR, Division of Inspection and Regional Support, to document problems, concerns, or difficulties encountered during implementation of the NRCs ROP.

To help ensure the consistent application of the security SDP and security SDP results, the staff shall perform an annual self-assessment of the security SDP and associated tools. This assessment shall be performed in accordance with IMC 0307, Appendix A, Reactor Oversight Process Self-Assessment Metrics and Data Trending.

0609E-08 SDP AND ENFORCEMENT REVIEW PANEL PROCEDURES Refer to the applicable sections in IMC 0609 or IMC 2519 Construction Significance Determination Process for information on the SDP and enforcement review panel procedures.

0609E-09 PROCESS FOR LICENSEE APPEAL OF A STAFF SDP DETERMINATION If a licensee disagrees with the staffs final determination of significance, the licensee may appeal the determination to the appropriate NRC regional administrator or appropriate office director; for FOF, NSIR is the issuing organization. Any such review must meet the requirements stated in the Prerequisites and Limitations sections described in Attachment 2 of IMC 0609 or IMC 2519. Specifically, the licensee must have opted for an opportunity to present additional information to the staff either by meeting with regional or headquarters management, as appropriate, at a regulatory conference or by submitting a written response on the docket.

Issue Date: 04/02/21 5 0609 Appendix E

0609E-10 USING THE SDP TO DETERMINE THE SIGNIFICANCE OF INSPECTION FINDINGS THAT ARE NOT VIOLATIONS OF THE LICENSING OR DESIGN BASIS The staffs use of the SDP to determine the significance of the result or consequence of a licensee performance deficiency will be made regardless of if the result or consequence constitutes a violation of a licensees licensing or design basis or any other regulatory requirement or commitment. Agency follow-up of such findings, if determined to be significant, will be handled in accordance with the backfit rules of 10 CFR 50.109, Backfitting, as appropriate.

0609E-11 REFERENCES MD 8.13, Reactor Oversight Process IMC 2200, Security Inspection Program for Construction IMC 0307, Appendix A, Reactor Oversight Process Self-Assessment Metrics and Data Trending IMC 0308, Attachment 3, Appendix E, Technical Basis for the Baseline Security Significance Determination Process IMC 0308, Attachment 6, Basis Document for the Security Cornerstone of the Reactor Oversight Process IMC 0609, Significance Determination Process IMC 0611, Power Reactor Inspection Reports IMC 0613, Power Reactor Construction Inspection Reports IMC 0801, Reactor Oversight Process Feedback Program IMC 2201, Security Inspection Program for Operating Commercial Nuclear Power Reactors IMC 2519, Construction Significance Determination Process END Attachments:

Revision History for IMC 0609, Appendix E Issue Date: 04/02/21 6 0609 Appendix E

Attachment 1 Revision History - IMC 0609 Appendix E Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Form Number Issue Date Required and Accession Number (Pre-Change Notice Completion Decisional, Non-Public Date Information)

N/A 07/21/2005 Initial issuance N/A N/A ML12335A203 Total rewrite; revision incorporates Part III, N/A N/A 11/30/12 Construction Fitness-for-Duty Significance CN 12-027 Determination Process (CFFDSDP) and clarifies additional sections.

N/A ML15253A850 This document was revised to N/A ML15253A861 10/08/15 administratively incorporate Part IV, Cyber CN 15-019 Security Significance Determination Process for Power Reactors (CSSDP), and to reflect minor administrative changes.

N/A ML20295A356 This document was revised to incorporate N/A ML20295A358 04/02/21 organizational changes and other CN 21-018 administrative changes.

Issue Date: 04/02/21 Att1-1 0609 Appendix E