ML25232A186

IMC 0308 Attachment 6, Basis Document for Security Cornerstone of the Reactor Oversight Process

ML25232A186
Person / Time
Issue date:	09/24/2025
From:	Jeffrey Bream NRC/NSIR/DSO/SOSB
To:
References
CN 25-031
Download: ML25232A186 (1)

Text

Issue Date: 09/24/25 1

0308 Att 6 NRC INSPECTION MANUAL NSIR/DSO INSPECTION MANUAL CHAPTER 0308 ATTACHMENT 6 BASIS DOCUMENT FOR SECURITY CORNERSTONE OF THE REACTOR OVERSIGHT PROCESS Effective Date: January 1, 2026 0308.6-01 INTRODUCTION The security cornerstone of the Reactor Oversight Process (ROP) was originally called the physical protection cornerstone and was developed in the same manner as the other ROP cornerstones. The security cornerstone is intended to meet the same guiding principles and program objectives as the rest of the ROP. Those principles and objectives are described in Inspection Manual Chapter (IMC) 0305, Operating Reactor Assessment Program, and IMC 0308, Reactor Oversight Process Basis Document, and the source documents listed in Section 7.

0308.6-02 CORNERSTONE STRUCTURE AND OBJECTIVE The safeguards strategic performance area description contained in IMC 0308 provides the background and objective of the security cornerstone.

Key Attributes and Critical Elements Through expert panels, key attributes were described for each cornerstone. The key attributes were those areas within a cornerstone that needed to function for the associated licensee program or activity to meet the cornerstones objective. Within each key attribute, the staff then determined those specific elements (called critical elements) that needed to be verified to determine if the licensees performance and programs adequately met the key attribute and, therefore, met the cornerstones objective.

0308.6-03 INSPECTION The technical basis for the development of the inspection program for commercial power reactors for the security cornerstone is described in IMC 0308, Attachment 2, Technical Basis for Inspection Program.

Inspectable Areas The original physical protection cornerstone had four cornerstone-specific inspectable areas:

access control, access authorization, response to contingency events, and security plan changes. The scope of several of the inspectable areas was limited because performance indicators were being used to measure aspects of the area and, therefore, those aspects were not directly inspected under the baseline inspection program.

Following the events of September 11, 2001, the U. S. Nuclear Regulatory Commission (NRC) issued additional security requirements on its licensees and created the Office of Nuclear

Issue Date: 09/24/25 2

0308 Att 6 Security and Incident Response (NSIR) to increase oversight of security at its licensees. The NRC also initiated several analyses, evaluations, and studies to determine the vulnerabilities of its licensees to various scenarios and to develop strategies to reduce the vulnerabilities and mitigate the consequences of such scenarios. In addition, the agency revised its list of capabilities for the design basis threat against which power reactor licensees must be able to protect their plants. In SECY-04-0002, Revisions to the Power Reactor Physical Protection Baseline Inspection Program, (Agencywide Documents Access and Management System (ADAMS) accession number ML033390092, non-public) the NRC expanded the inspectable areas beyond the original four to provide high assurance that the physical protection system can protect against the design basis threat of radiological sabotage. The current inspection procedures reflect the expanded list of inspectable areas. The agency also removed from public access any security-related information that could potentially be of benefit to adversaries wishing to do harm to NRC licensees.

When the agency created NSIR, the NRC included in NSIRs responsibilities the oversight of material control and accounting (MC&A). An additional key attribute, MC&A, and associated critical elements were added to the security cornerstone in 2007. In 2013, the Office of Nuclear Material Safety and Safeguards (NMSS), via memorandum (ML13309A697, non-public),

assumed the responsibility for oversight of MC&A however, the key attributes and the critical elements continue to remain in the security cornerstone.

0308.6-04 PERFORMANCE INDICATORS When the ROP was developed, the staff attempted to relate Performance Indicators (PI) thresholds to probabilistic risk data. For those that could not be tied to probabilistic risk data, the PI thresholds were tied to regulatory requirements or were based on the professional judgment of the NRC staff. In the security cornerstone, the PI provides a useful measure of the status of systems, but its thresholds were chosen based on the professional judgment of the NRC staff.

The PI in the security cornerstone does not have thresholds identified for the Yellow or Red Bands because there is no risk basis for a determination that a certain degraded level of performance reflected by this indicator can be correlated into mandatory plant shutdown. It is expected that declining performance in the area monitored by the indicator would be interrupted by increased licensee corrective actions and by increased NRC attention (if different from the parent IMC).

0308.6-05 SIGNIFICANCE DETERMINATION PROCESS The purpose of the Baseline Security Significance Determination Process (BSSDP) is to provide an objective means of evaluating findings related to common defense and security for activities licensed by the NRC as defined in IMC 2201, Security Inspection Program for Operating Commercial Nuclear Power Reactors. The process also is used to provide reasonable assurance1 that licensees safeguards systems can provide adequate protection against the DBT based on defense-in-depth layers of protection as part of licensees commitments to NRC 1

SRM-SECY-16-0073, Options and Recommendations for the Force-on-Force Inspection Program in Response to SRM-SECY-14-0088, states, In implementing the NRC's regulatory program, either in developing new regulations, inspecting licensee compliance with regulations, or executing the FOF program, the staff should be mindful that the concept of high assurance of adequate protection found in our security regulations is equivalent to reasonable assurance when it comes to determining what level of regulation is appropriate.

Issue Date: 09/24/25 3

0308 Att 6 requirements. The BSSDP incorporates areas of MC&A, protection of Safeguards Information, and physical protection. The BSSDP is utilized once a performance deficiency has been evaluated as more than minor using IMC 0612, Appendix B, Issue Screening Directions, and determined to be in the security area in accordance with IMC 0609, Attachment 4, Initial Characterization of Findings.

0308.6-06 PUBLIC ACCESS TO INFORMATION In November 2003, the Commission asked the staff to present it with options for addressing the security cornerstone of the ROP. The staff sent the Commission several options (see SECY-04-0020, Treatment of Physical Protection Under the Reactor Oversight Process, ML033280551, non-public) with no change to the then current process and ending with a completely different process for assessing security. The Commission chose an option that kept the security cornerstone in the ROP but assessed security separate from the other ROP cornerstones. The Commission specifically directed the staff to make no information publicly available (see SRM-SECY-04-0020, "Treatment of Physical Protection Under Reactor Oversight Process, ML040900126, non-public).

The staff implemented the Commissions direction in August 2004, by removing from the NRCs public web pages the ROP assessment information related to the security cornerstone and making non-safeguards, security-related inspection documents official use only. At the time, no security-related inspection reports or their cover letters were public because of an earlier response to the events of September 11, 2001. However, in July 2011, the Commission approved staffs proposal to reintegrate security inspection findings and PIs into the Action Matrix of the ROP for commercial nuclear power licensees. The Commission also approved the staffs recommendation that the proposal be considered, where applicable and appropriate, for other NRC security inspection and oversight programs, such as reactors under construction (see SRM-SECY-11-0073, Staff Proposal to Reintegrate Security Into the Action Matrix of the Reactor Oversight Process Assessment Program, ML112020038, non-public).

Also, by Commission direction (see SRM-SECY-04-0191, Withholding Sensitive Unclassified Information Concerning Nuclear Power Reactors from Public Disclosure, ML043140175, non-public), the staff later provided new options to make certain information about security inspections publicly available. The Commission chose an option that would identify that a security inspection had been performed and that findings had been identified. However, the Commission directed the staff to make public only certain, limited information regarding the inspections and associated findings. Details regarding the nature of any findings as well as the number findings that were greater-than-green in significance were withheld from public disclosure.

0308.6-07 REFERENCES COMSECY-19-0006: Revised Security Inspection Program Framework (Option 3) in Response to SRM-SECY-17-0100 (ML19038A485) (non-public)

IMC 0305, Operating Reactor Assessment Program IMC 0308, Reactor Oversight Process Basis Document IMC 0609, Significance Determination Process

Issue Date: 09/24/25 4

0308 Att 6 IMC 0609, Appendix E, Physical Protection Significance Determination Process for Power Reactors IMC 0612, Appendix B, Issue Screening Directions IMC 2201, Security and Safeguards Inspection Program for Commercial Power Reactors Nuclear Energy Institute NEI-99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, 31 August 2013 SECY-04-0002, Revisions to the Power Reactor Physical Protection Baseline Inspection Program (ML033390092) (non-public)

SECY-04-0020, Treatment of Physical Protection Under the Reactor Oversight Process (ML033570084) (non-public)

SECY-04-0091, Provisional Physical Protection Determination Process to Evaluate Findings from the Security Baseline Inspection and Force-on-Force Inspection Programs (ML040130797) (non-public)

SECY-05-0082, Revised Assessment Process for the Security Cornerstone of the Reactor Oversight Process (ML051090579) (non-public)

SECY-05-0107, Status of Activities and Improvements to the Physical Protection Significance Determination Process (ML051640574) (non-public)

SECY-06-0036, Public Disclosure Options within the Security Cornerstone of the Reactor Oversight Process (ML053070279) (non-public)

SECY-07-0015, Results of Trial Assessment of the Industry's Optional Physical Protection Significance Determination Process (ML070080171) (non-public)

SECY-07-0136, Recommendation to Discontinue Two of Three Performance Indicators Associated with the Security Reactor Oversight Process, (ML062760640) (non-public)

SECY-08-0005, Results of Material Control and Accounting Baseline Inspections Conducted at Nuclear Power Reactors and Wet Storage Sites, (ML072841277) (non-public)

SECY-11-0073, Staff Proposal to Reintegrate Security into the Action Matrix of the Reactor Oversight Process Assessment Program (ML112020038) (non-public)

SECY-16-0073 (ML17223A335), Options and Recommendations for the Force-on-Force Inspection Program in Response to SRM-SEC-14-0088 (ML16279A345). (non-public)

SECY-99-007, Recommendations for Reactor Oversight Process Improvements (ML992740074) (non-public)

SECY-99-007A, Recommendations for Reactor Oversight Process Improvements Follow Up to SECY-99-007) (ML992740073) (non-public)

SRM-COMSECY-19-0006: Revised Security Inspection Program Framework (Option 3) in Response to SRM-SECY-17-0100 (ML24138A045) (non-public)

Issue Date: 09/24/25 5

0308 Att 6 SRM-SECY-04-0020, "Treatment of Physical Protection Under the Reactor Oversight Process" (ML040900126) (non-public)

SRM-SECY-04-0191, Withholding Sensitive Unclassified Information Concerning Nuclear Power Reactors from Public Disclosure (ML043140175) (non-public)

SRM-SECY-05-0082, Revised Assessment Process for the Security Cornerstone of the Reactor Oversight Process (ML052280031) (non-public)

SRM-SECY-07-0136, Recommendation to Discontinue Two of Three Performance Indicators Associated with The Security Reactor Oversight Process, (ML072560811) (non-public)

SRM-SECY-11-0073, Staff Proposal to Reintegrate Security Into the Action Matrix of the Reactor Oversight Process Assessment Program (ML112020038) (non-public)

END List of Exhibits:

Exhibit 1: IP 71130.01, Access Authorization Exhibit 2: IP 71130.02, Access Control Exhibit 3: IP 71130.03, Contingency Response - Force-on-Force Testing Exhibit 4: IP 71130.04, Equipment Performance Testing and Maintenance Exhibit 5: IP 71130.05, Protective Strategy Evaluation and Performance Evaluation Program Exhibit 6: IP 71130.06, (Reserved)

Exhibit 7: IP 71130.07, Security Training Exhibit 8: IP 71130.08, Fitness-for-Duty Program Exhibit 9: IP 71130.09, Security Plan Changes Exhibit 10: IP 71130.10, Cybersecurity Exhibit 11: IP 71130.11, Material Control and Accounting Exhibit 12: IP 71130.12, (Reserved)

Exhibit 13: IP 71130.13, (Reserved)

Exhibit 14: IP 71130.14, Review of Power Reactor Target Sets Exhibit 15: IP 92707, Security Inspection of Facilities Impacted by a Local, State, or Federal Emergency Where the U.S. Nuclear Regulatory Commission's Ability to Conduct Triennial Force-on-Force Exercises is Limited Exhibit 16: IP 71151, Performance Indicator Verification List of Attachments:

Revision History Table

Issue Date: 09/24/25 6

0308 Att 6 Exhibit 1: IP 71130.01, Access Authorization BASIS

SUMMARY

SHEET Inspectable Area: Access Authorization Cornerstone: Security Inspection Procedure: 71130.01 Scope: To verify the licensee is properly implementing its personnel screening and fitness-for-duty (FFD) programs, including granting, denying, and revoking unescorted access authorization into the protected area, as appropriate, as well as verifying all other applicable areas of access authorization are being properly implemented. The frequency at which this inspection activity is to be conducted is triennially (once every 3 years).

Basis: Inspection of this area supports the security cornerstone. This is a risk-significant area because the personnel screening and FFD processes are used to verify personnel reliability and trustworthiness prior to granting unescorted access to the site protected and vital areas, and to assure continued reliability and trustworthiness throughout the period of unescorted access and authorization. The establishment of reliability and trustworthiness for persons granted unescorted access to the protected area is a major component of protection against the insider threat of radiological sabotage as defined in 10 Code of Federal Regulations (CFR) 73.1. The behavioral observation process is used to monitor the continuation of trustworthiness for persons authorized unescorted access and for escorted visitors.

An individual with malevolent intent or an individual under the influence of drugs could be granted unescorted access due to human or program failure. The frequency of this type of event has been low but the safety significance of this type of event can be medium to high.

The probability of a single individual causing a radiological release is low although the consequences of an individual causing a radiological release can be high depending on the individuals knowledge of plant systems.

Historically, licensees have effectively implemented the personnel screening and FFD programs. The licensee is required by 10 CFR 73.56 to maintain an access authorization program, which includes background investigations and psychological assessments, for granting individuals unescorted access to protected and vital areas with the objective of providing reasonable assurance that the individuals are trustworthy and reliable and do not constitute an unreasonable risk to public health and safety including the potential to commit radiological sabotage. The licensee is also required by 10 CFR 26.23 to maintain an FFD program that provides reasonable assurance that the workforce will perform tasks in a reliable and trustworthy manner and that they are not under the influence or impaired from any cause.

Both rules require behavioral observation to detect indications of behavioral problems that could constitute a threat to public health and safety.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001.

2007: SECY-07-0136 removed the two security PIs that affected this inspectable area as the area is now fully inspected.

Issue Date: 09/24/25 7

0308 Att 6 Exhibit 2: IP 71130.02, Access Control BASIS

SUMMARY

SHEET Inspectable Area: Access Control Cornerstone: Security Inspection Procedure: 71130.02 Scope: To verify that the licensee has effective access controls and equipment in place designed to detect and prevent the introduction of contraband (firearms, explosives, incendiary devices) into the protected area that could be used to commit radiological sabotage and to assure that only authorized personnel are permitted unescorted access to the site protected area and vital areas. The identification and authorization process are to ensure that, once personnel have been screened to verify their trustworthiness and reliability, those persons have a need for access and to confirm that only those persons who have been screened and have a need are granted access to the plant including vital areas. Some of the equipment involved in the search process are metal detectors, explosive detectors, x-ray machines, biometric sensors, computers, keycards, hard keys, and card-readers. The frequency at which this inspection activity is to be conducted is annually (once per calendar year).

This inspection also verifies that safeguards information is stored in a manner that prevents unauthorized access or disclosure. This includes verification of storage locations, personnel with authorized access, and implementing procedures.

Basis: Inspection of this area supports the security cornerstone. The areas to measure are the effectiveness of the search (personnel, packages and vehicles) and the identification and authorization functions. The search function is to prevent the introduction of contraband (firearms, explosives, incendiary devices) that could be used to commit radiological sabotage.

The search function for detection of firearms, explosives and incendiary devices on individuals, in packages, or vehicles, is accomplished by equipment and/or a hands-on search.

The identification and authorization functions are accomplished during issuing of badges and through using biometrics or card-readers. The licensee must also positively control all points of personnel, material and access into the protected areas.

Verification of the safeguards information protection process and systems provides reasonable assurance that only authorized personnel with an appropriate need-to-know have access to protected information.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001.

2018: Verification of safeguards information storage added to IP following the reclassification of IP 71130.06 from triennial to as needed.

Issue Date: 09/24/25 8

0308 Att 6 Exhibit 3: IP 71130.03, Contingency Response - Force-on-Force Testing BASIS

SUMMARY

SHEET Inspectable Area: Contingency Response - Force-on-Force Testing Cornerstone: Security Inspection Procedure: 71130.03 Scope: Verify that the licensee has the capability to protect its target sets against the design basis threat. The implementation of the protective strategy includes demonstrating that the strategy works, and that the security force can successfully protect against the design basis threat through drills and exercises. The frequency at which this inspection activity is to be conducted is triennially (once every 3 calendar years).

Basis: Inspection of this area supports the security cornerstone. This is a high risk-significant system necessary to protect against the design basis threat of radiological sabotage. The licensee should be able to demonstrate the ability to respond with sufficient force, properly armed, appropriately trained, and within the appropriate time to protected positions in order to interdict and neutralize the design-basis adversary force to protect target sets necessary for the safe shutdown of the plant.

The ability of the security force to respond to the design basis threat is contingent upon the effective implementation of the physical protection program including, but not limited to, the number of armed responders team personnel committed to in the physical security plan; the intrusion detection system being able to detect; the alarm status being communicated to the alarm stations; the assessment functions (closed-circuit television and lighting) and the training of central alarm station and secondary alarm station operators, communications on and off site, the response officers and response team leaders, including handling and qualification with assigned weapons, and the use of proper tactics. Each of these items will be reviewed to determine if they can perform their intended function against the design basis threat and as identified in the Security Plan.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2000: Operational Security Response Evaluation (OSRE) force-on-force drills are conducted per IP 81110, "Operational Safeguards Response Evaluation (OSRE)."

2002: The staff piloted and then expanded a force-on-force program that could be incorporated into the routine oversight of nuclear power reactors. This expansion included the use of trained controllers, use of NRC supplied laser-engagement weapon platform systems, minimizing artificialities, credible, realistic challenges to the protective strategies and the use of a mock adversary force.

2004: The inspectable area attachment was rewritten to make the force-on-force exercises a routine part of the NRCs inspection oversight considering September 11, 2001. This IP was changed from a biennial, non-force-on-force inspection to a triennial force-on-force exercise inspection conducted by NSIR headquarters.

2014: FOF program revised from three exercises to two exercises.

2025: FOF program revised from two exercises to one with an enhanced inspection of the licensee Performance Evaluation Program, per SRM-COMSECY-19-0006

Issue Date: 09/24/25 9

0308 Att 6 Exhibit 4: IP 71130.04, Equipment Performance Testing and Maintenance BASIS

SUMMARY

SHEET Inspectable Area: Equipment Performance, Testing, and Maintenance Cornerstone: Security Inspection Procedure: 71130.04 Scope: To verify the operability and performance of all security equipment identified for use in the security plan and implementing procedures. This includes, intrusion detection and assessment, physical barriers, response force weapons, communications equipment, and equipment utilized to perform access control search functions. The frequency at which this inspection activity is to be conducted is biennially (once every 2 years).

Basis: Inspection of this area supports the security cornerstone. The functionality, reliability, and sensitivity of security system equipment are critical to the effective implementation of a plants security program.

Performance Indicator(s): The Protected Area Security Equipment Performance Index affects this inspectable area, as this procedure inspects the availability of the PA boundary intrusion detection and assessment equipment. However, no reduction in scope of inspection is made for the PI. See the PIs basis summary sheet, Exhibit 17, below.

Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001.

Issue Date: 09/24/25 10 0308 Att 6 Exhibit 5: IP 71130.05, Protective Strategy Evaluation and Performance Evaluation Program BASIS

SUMMARY

SHEET Inspectable Area: Protective Strategy Evaluation and Performance Evaluation Program Cornerstone: Security Inspection Procedure: 71130.05 Scope: To verify that the plants protective strategy remains effective. Review site security plans and associated procedures and licensee conducted drills and exercises. The frequency at which this inspection activity is to be conducted is triennially (once every 3 years)

Basis: Inspection of this area supports the security cornerstone. An effective protective strategy is necessary to ensure safety of a plant during an attack by a design-basis threat-level force. Therefore, it is an important aspect of the licensees contingency response.

The ability of the security force to effectively respond to the design basis threat is contingent upon the number of armed response team personnel committed to in the physical security plan, the intrusion detection system being able to detect, the alarm status being communicated to the alarm stations, the assessment functions (closed-circuit television and lighting) and the training of central alarm station and secondary alarm station operators, communications on and off site, the response officers and response team leaders, including handling and qualification with assigned weapons, and the use of proper tactics. Each of these items will be reviewed to determine if they can perform their intended function against the design basis threat and as identified in the Security Plan (Physical, Contingency, Training and Qualified).

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 added the force-on-force inspectable area (71130.03) into the program in response to September 11, 2001, and this inspectable area was expanded and renumbered as 71130.05.

2014: Inspection procedure revised to include observation of licensee-conducted annual force-on-force exercise

Issue Date: 09/24/25 11 0308 Att 6 Exhibit 6: IP 71130.06 (Reserved)

BASIS

SUMMARY

SHEET Inspectable Area: (Reserved)

Cornerstone: Security Inspection Procedure: 71130.06 Scope:

Basis:

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: IP issued as Inspection of Security Plan Changes per SECY-04-0002.

2007: IP deleted, and function transitioned to NSIR program office.

2010 IP 71130.06 reissued as Protection of Safeguards Information.

2024: Previous IP 71130.06, Protection of Safeguards Information was renumbered to IP 81822 and moved to IMC 2201, Appendix C. IP 71130.06 was reserved for future use.

Issue Date: 09/24/25 12 0308 Att 6 Exhibit 7: IP 71130.07, Security Training BASIS

SUMMARY

SHEET Inspectable Area: Security Training Cornerstone: Security Inspection Procedure: 71130.07 Scope: Review of initial, continuing, and requalification training for licensee personnel performing security functions. Inspection includes weapons familiarization, qualification, and tactical response courses of fire. The frequency at which this inspection activity is to be conducted is biennially (once every 2 years).

IP 71130.07EW was developed to verify licensee compliance with stand-alone or combined firearms preemption authority for applicable licensees. Verification of storage, accountability, transfer, and officer background checks are included in the attachment.

Basis: Inspection of this area supports the security cornerstone. Effective implementation of a licensees protective strategy and effective defense against the design basis threat depends on having properly training and qualified security officers who are properly equipped.

The comprehensive review following September 11, 2001, and the additional requirements imposed by orders broadened the scope of areas the NRC determined it needed to verify through its baseline inspection program. The scope was broadened to include educating and raising awareness of personnel to respond to postulated attacks.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001.

2024: IP 71130.07EW attachment was developed and issued.

Issue Date: 09/24/25 13 0308 Att 6 Exhibit 8: IP 71130.08, Fitness-for-Duty Program BASIS

SUMMARY

SHEET Inspectable Area: Fitness-for-Duty Program Cornerstone: Security Inspection Procedure: 71130.08 Scope: An initial inspection of the full scope of the licensees programs, then periodic inspections of program changes. The frequency at which this inspection activity is to be conducted is triennially (once every 3 years).

Basis: Inspection of this area supports the security cornerstone. Protection and defense against the design basis threat requires that the licensees staff not be impaired in performing their assigned duties.

The comprehensive review following September 11, 2001, and the additional requirements imposed by Orders broaden the scope of areas the NRC determined it needed to verify through its baseline inspection program. This area was broadened by adding areas to be inspected.

SRM-SECY-07-0136, dated September 13, 2007, recommended that the FFD PI be discontinued because the aspects of security programs measured by the PI are assessed by the BIP, and that this redundancy challenged efficiency and caused undue regulatory burden.

Further, the data gained, and insights provided by the PI (1) have been of limited additional value to the security ROP and (2) are already reported to the NRC through 10 CFR reporting requirements.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001.

Issue Date: 09/24/25 14 0308 Att 6 Exhibit 9: IP 71130.09, Security Plan Changes BASIS

SUMMARY

SHEET Inspectable Area: Security Plan Changes Cornerstone: Security Inspection Procedure: 71130.09 Scope: Inspection activities in this area focus upon those changes made by a licensee to the site Physical Security Plan, Safeguards Plan, or Training and Qualification Plan without prior Commission approval under the provisions of 10 CFR 50.54. The inspection activities include a review of the documentation submitted by a licensee as specified by 10 CFR 50.54. A more detailed review would be performed on those changes made without prior Commission approval where a decrease of effectiveness has or could have resulted from the change or on those changes that have the potential to be and/or appear to be intent changes. The frequency at which this inspection activity is to be conducted is annually (once per calendar year).

Basis: Inspection of this area supports the security cornerstone. Inspection in this area provides verification that changes to the licensees security plan do not result in a decrease in effectiveness of the plan to protect the site from the design basis threat of radiological sabotage.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: IP issued as Owner Controlled Area Controls per SECY-04-0002.

2008: IP deleted, and requirements added to IP 71130.05.

2013: IP issued as Licensee Performance Evaluation Program pilot.

2013: IP deleted, and requirements added to IP 71130.05.

2020: IP issued as Security Plan Changes returning the inspection and verification of security plan changes to the regions.

Issue Date: 09/24/25 15 0308 Att 6 Exhibit 10: IP 71130.10, Cybersecurity BASIS

SUMMARY

SHEET Inspectable Area: Cybersecurity Cornerstone: Security Inspection Procedure: 71130.10 Scope: This area will verify that the licensee has effectively implemented its cybersecurity plan and adequately protects digital computers, communication systems, important to safety, security, and emergency preparedness (SSEP) functions from cyber-attacks. The frequency at which this inspection activity is to be conducted is biennially (once every 2 years).

Basis: Establishing a cyber security program and implementing a cyber security plan is important in maintaining the digital security of SSEP functions. The following cyber security plan components make up a comprehensive cyber security program;

1)

Establishing and Implementing a program

2)

Boundary Protection

3)

Portable Media Protection

4)

Personnel Security

5)

Maintenance

6)

Training

7)

Digital Access Controls

8)

Audit and Accountability

9)

Communications Protection

10)

User Identification and Authentication

11)

System Hardening and Detection/Response

12)

System Integrity (Protection against Malicious Code)

13)

Physical Protection and Physical Access Control

14)

Defense in Depth

15)

Attack Mitigation and Incident Response

16)

Continuity of Operations

17)

Configuration Management

18)

Acquisition and Supply Chain Performance Indicator(s): None Significant Changes in Scope or Bases:

2017: Initial issuance as pilot.

2021: IP made effective as a permanent inspection (2022-2023 biennial inspection cycle).

Issue Date: 09/24/25 16 0308 Att 6 Exhibit 11: IP 71130.11, Material Control and Accounting BASIS

SUMMARY

SHEET Inspectable Area: Material Control and Accounting Cornerstone: Security Inspection Procedure: 71130.11 Scope: The scope of this key attribute is verifying the effectiveness of records, procedures and physical inventories used to control and account for special nuclear materials (SNM) at nuclear power plants. This inspection procedure is to be conducted triennially (once every 3 years), to verify the completeness of SNM records and reports, the adequacy of program and procedures, and the accurate conduct of physical inventory of SNM.

Basis: Inspection of this area supports the security cornerstone. Protection against the loss or misuse of special nuclear material (SNM), i.e., enriched uranium or plutonium, is a critical function of a plants security program. MC&A works in concert with physical protection to complete the security cornerstone with MC&A providing a record of the quantity and location of SNM at the facility, while physical protection protects the facility and the SNM located there.

MC&A provides for the timely detection of loss, theft or diversion of SNM. The inspection in this key attribute of the security cornerstone and is used to assess the effectiveness of the licensees program for control and accounting of SNM. The factors that decrease the risk of loss of SNM are: (1) developing, maintaining and implementing appropriate procedures; (2) generating and maintaining records; and (3) conducting physical inventories.

In 1988, the MC&A inspections were changed from routine to as needed in the IMC 2515, Light Water Reactor Inspection Program Operations Phase. Beginning in 2004, due to a licensees loss of two fuel rods, the MC&A inspections were conducted under a three-phase temporary instruction (TI 2515/154, Material Control and Accounting at Nuclear Power Plants and Wet Storage Sites). The results of these inspections were documented in SECY 0005, Results of Material Control and Accounting Baseline Inspections Conducted at Nuclear Power Reactors and Wet Storage Sites. In SECY-05-0082, the staff indicated that MC&A would be added as a key attribute to the Security oversight program because of the importance of control of radioactive material to national security, the identification of unaccounted for fuel pieces, and the integration of materials safety and security in the agencys strategic goals. In response to Commission direction, MC&A was added to the IMC 2201, Security Inspection Program for Operating Commercial Nuclear Power Reactors. At the same time, the Physical Protection Significance Determination Process (SDP) was revised to include MC&A and renamed the Baseline Security SDP. Enforcement history, inspection experience, and expert judgment were used in the development of the MC&A portion of the Baseline Security SDP.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2005: SECY-05-0082 stated that MC&A would be added as a key attribute to the security cornerstone.

2007: Exhibit 11 to IMC 0308 was revised in November 2007 to include this key attribute.

2008: IMC 0320 incorporated MC&A as a key attribute to the cornerstone.

Issue Date: 09/24/25 17 0308 Att 6 Exhibit 12: IP 71130.12 (Reserved)

BASIS

SUMMARY

SHEET Inspectable Area: (Reserved)

Cornerstone: Security Inspection Procedure: 71130.12 Scope:

Basis:

Performance Indicator(s): None Significant Changes in Scope or Bases:

Issue Date: 09/24/25 18 0308 Att 6 Exhibit 12: IP 71130.13 (Reserved)

BASIS

SUMMARY

SHEET Inspectable Area: (Reserved)

Cornerstone: Security Inspection Procedure: 71130.13 Scope:

Basis:

Performance Indicator(s): None Significant Changes in Scope or Bases:

Issue Date: 09/24/25 19 0308 Att 6 Exhibit 14: IP 71130.14, Review of Power Reactor Target Sets BASIS

SUMMARY

SHEET Inspectable Area: Review of Power Reactor Target Sets Cornerstone: Security Inspection Procedure: 71130.14 Scope: Verify that (1) the licensee has developed, revised as necessary, and is implementing a process to identify, document, and maintain site specific target sets to inform the sites protective strategy, (2) a sample of the licensees complete and accurate target sets includes consideration of cyber-attacks and cyber critical digital assets (CDAs) in documented target sets, and (3) that the licensee includes review of target sets as an element of the physical protection program review as required by Title 10 of the Code of Federal Regulations 73.55(m). The frequency at which this inspection activity is to be conducted is triennially (once every 3 years).

Basis: Inspection of this area supports the security cornerstone. The development and maintenance of complete and accurate target sets is necessary to identify which plant structures, systems, and components need to be protected to prevent significant core damage and spent fuel sabotage, which serve as the primary basis for the development of the sites protective strategy. If complete and accurate target sets are not developed and maintained, a sites protective strategy might not be effective against the design basis threat.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2004: SECY-04-0002 revised security baseline inspection program, broadening the scope of this area in response to the NRCs security review following September 11, 2001 2013: Revision 2 removed information regarding Part 100 releases which is no longer considered in the Significance Determination Process and included updated information regarding cyber aspects to target sets and spent fuel pools.

2013: Revision 3 to IP 71130.14 is a complete re-write and was issued to revise the procedure to only inspect the changes since the last target set inspection and a small sample of target sets for completeness and accuracy.

Issue Date: 09/24/25 20 0308 Att 6 Exhibit 15: IP 92707, Security Inspection of Facilities Impacted by a Local, State, or Federal Emergency Where the U.S. Nuclear Regulatory Commission's Ability to Conduct Triennial Force -on-Force Exercises is Limited BASIS

SUMMARY

SHEET Inspectable Area: Response to Contingency Events Cornerstone: Security Inspection Procedure: 92707 Scope: The scope of this IP mirrors the scope of IP 71130.03. Modifications were made to limit personnel exposure to potentially hazardous conditions. This IP is performed in place of IP 71130.03, as needed.

Basis: The basis of this IP mirrors the basis of IP 71130.03. Modifications were made in response to the COVID-19 public health emergency in order for the NRC to fulfill its statutory requirements related to FOF exercise performance, while limiting the exposure of NRC and licensee personnel to potential hazards.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2020: Initial issuance.

Issue Date: 09/24/25 21 0308 Att 6 Exhibit 16: IP 71151, Performance Indicator Verification BASIS

SUMMARY

SHEET Inspectable Area: Security Performance Indicator Cornerstone: Security Inspection Procedure: 71151 Scope: The PI is used to monitor security equipment unavailability of the perimeter intrusion detection and assessment system. The PI also promotes good practices. Although the NRC is actively overseeing the security cornerstone, the Commission has decided that the description of this PI and its results will not be publicly available to ensure that potentially useful information is not provided to a possible adversary. The frequency at which this inspection activity is to be conducted is annually (once per calendar year).

Basis: This PI was developed and agreed to by an expert panel composed of NRC and industry representatives, based on the collection and review of historical data.

Performance Indicator(s): None Significant Changes in Scope or Bases:

2007: SECY-07-0136 removed two of the three security PIs because the 2004 revision to the security baseline inspection program now inspects those aspects of security that had been reported by the PIs. Although the baseline inspection program now inspects the aspects of security that this PI also measures, the NRC has kept this PI in the program because of its promotion of good practices.

Issue Date: 09/24/25 Att1-1 0308 Att 6 : Revision History for IMC 0308 Attachment 6 Commitment Tracking Number Accession Number Issue Date Change Notice Description of Change Description of Training Required and Completion Date Comment Resolution and Closed Feedback Form Accession Number (Pre-Decisional Non-Public Information)

N/A ML081480024 09/08/09 CN 09-021 Initial issuance separating the basis for the security cornerstone from the rest of the ROP because of information sensitivity.

N/A ML091380039 ML19116A201 11/09/20 CN 20-061 Periodic update: incorporated regional comments and updated the formatting to current IMC-0040 standards.

Updated Basis Summary Sheets, including rewrite of Figure 8, Information Technology Security (Cyber Security); and added Figure 10, Security Performance Index.

Completed a SUNSI review and concluded that this document does not need to be controlled.

Consistent with the staffs SUNSI determination, SUNSI markings were removed.

N/A ML19233A213 ML24264A152 09/24/25 CN 25-031 Update to reflect changes in FOF inspection program. Additional updates made to reflect addition of SGI storage verification to IP 71130.02, remove IP 71130.06, add firearms preemption authority to IP 71130.07, update revision history of IP 71130.09, and add IP 92707. Other editorial changes made.

N/A ML24264A150