ML19211B294

July 25, 2019 Controlled Unclassified Information Public Meeting Transcript

ML19211B294
Person / Time
Issue date:	07/25/2019
From:	NRC/OCIO
To:
Tanya Mensah 415-3610
References
Download: ML19211B294 (98)

Text

Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION ADAMS Accession No. ML19211B294

Title:

Public Meeting on NRC Controlled Unclassified Information Docket Number: (n/a)

Location: Rockville, Maryland Date: Thursday, July 25, 2019 Work Order No.: NRC-0465 Pages 1-95 NEAL R. GROSS AND CO., INC.

Court Reporters and Transcribers 1323 Rhode Island Avenue, N.W.

Washington, D.C. 20005 (202) 234-4433

1 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION

+ + + + +

PUBLIC MEETING ON NRC CONTROLLED UNCLASSIFIED INFORMATION (CUI)

+ + + + +

THURSDAY, JULY 25, 2019

+ + + + +

ROCKVILLE, MARYLAND

+ + + + +

The Public Meeting convened in the Commissioners' Hearing Room at the Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, at 1:00 p.m., Dan Mussatti, Moderator, presiding.

NRC STAFF PRESENT:

DAN MUSSATTI, NRO, Moderator JAMES ADLER, OGC CRAIG ERLANGER, NRR SCOTT FLANDERS, OCIO LISAMARIE JARRIEL, OE MARK LOMBARD, NSIR KATHY LYONS-BURKE, OCIO TANYA MENSAH, OCIO NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

2 NICHOLAS MERTZ, OGC JOHN MOSES, OCIO ROB NORMAN, NSIR AMY ROUNDTREE, ADM BERN STAPLETON, NSIR ALSO PRESENT:

PAT ASENDORF, Tennessee Valley Authority*

JIM BARSTOW, Exelon EDMOND LEE, NARA STEVE MEYER, STARS Alliance MAGGIE STAIGER, NEI CHARLENE WALLACE, NARA

• via telephone NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

3 P R O C E E D I N G S 1:14 p.m.

MR. MUSSATTI: Let's get started here.

It's about 15 after the hour, which is kind of on time for us. I'm really surprised that everything went as smoothly as it did. This is the first time where we've ever had to do this Chinese fire drill with the commission needing the room while we were needing to set the room up. But whoever was here to help us set this room up, I really appreciate your help.

My name is Dan Mussatti. I'm going to be your facilitator today helping to make sure that things move smoothly. My job is to make sure that the information -- the lines should be open right now.

Are they? Melinda?

OPERATOR: The lines are open.

MR. MUSSATTI: Okay, good. So we've got people on the telephone so I'll have some special rules for them in a minute. But my job here is to make sure that the information flows freely back and forth here.

The main way it's going to be laid out is that there's going to be some presentations followed by some question and answer periods. So please hold any of your questions until then.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

4 Before we get started, I'd like to take care of a little bit housekeeping. You may have overheard here a minute ago we're not supposed to have food or drink in this room, but it's a little late for that. Please make sure you take your trash with you when you leave. We want to leave this place clean because I really appreciate having a room that works this well when I have to facilitate. It makes my job easier and makes me look like I know what I'm doing.

With regard to getting around in the building, if you are a guest, your badge now gives you full access to this main floor except for behind the guards' stations that go to the elevators. If you needed to go in there for any reason, you'd have to have an escort. But you've got access all the way from where you came in and badged in all the way down to the cafeteria and our little gift store that's right over there, and the Starbucks.

So when we take our break, be aware that it's a long distance down to the Starbucks and get a coffee and then come back. And we want to start on time after the break, so please plan accordingly. The restrooms here, if this is your first time, leave by this door over here on your left, and turn left. And NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

5 about 50 feet down on the right-hand side I think it is the ladies room. Left-hand side. And the men's room is on the right-hand side right before you get to the glass doors.

If we're asked to evacuate this building for any reason at all, please follow the directions of the guards that are outside here. What we want to do is we want to cross across the plaza as close to the main road as possible over there and gather so that we can take a counting of heads, make sure we've got everybody out of the building safely. Which reminds me, has anyone in here not signed in? That's our only way of knowing that you were here with us when we count heads. We don't want to leave your head in the building if something was to be an emergency and we had to get out. So I'm glad everyone has signed in.

Today's meeting is a category 3 meeting.

Category 3 meetings are typically held with a group of industry representatives, licensees, vendors and members of the public, and are facilitated to ensure that the issues and concerns are presented, understood and considered by the NRC.

You have an agenda and we invite you to provide comments and questions to us at the appropriate NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

6 times. If it were in the middle of a presentation and the urge really strikes you to ask a question, please suppress it. You'll get a chance later on. Write it down so you don't forget it. But we would like to go through the presentations completely. Sometimes a question you ask is going to be answered later on in the presentation anyway. So it's just more efficient that way.

For people in the room, when you do ask questions, we ask that you proceed to the microphones and queue up for me so that when we get to that point, I'll just indicate it's your turn to talk. Every once in a while I'll jump from the floor up to the operator and we'll talk to the people that are on the phones.

Right now I would like to ask you if you've got any electronic device on you that buzzes, beeps, or in any other way is bothersome, please put it on mute or shut it off entirely. I know there are some people that because for safety reasons we can't turn our phones off, we need to have them be available 24/7 for emergencies, and sometimes we have family members that need us to be available in case of an emergency.

So please make sure that it's silent. You don't necessarily have to shut it off, but make sure it's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

7 silent so that we're not disrupting anybody.

If you get a phone call and you need to take it, please make your way all the way out into the hallway before you answer it so that the disruption is as minimal as possible.

Okay. For folks that are on telephone lines, we have an external operator. Her name is Melinda, and she will be managing our bridge line for us here. Melinda, would you please take a moment to explain to our callers how they should coordinate with you to be able to get in line to ask questions?

OPERATOR: Thank you. And at this time for your questions when we do queue up for questions on the question-and-answer session, you may do so by pressing star one. Please ensure your phone is unmuted and clearly record your name. To withdraw your request, you may press star two at that time. Thank you.

MR. MUSSATTI: Thank you, Melinda. I really appreciate the help. It makes it much easier to have someone like you on the line.

Okay. In addition for those of you that are on the phone, I would like to have you e-mail your name and contact information to Tanya Mensah, that's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

8 T-A-N-Y-A.M-E-N-S-A-H@NRC.gov. That'll give us a complete record of who was here. And if at any time you folks on the phone can't hear, please let our Operator know and we will do whatever we can to get you back into a position where you can be a portion of this meeting.

One last thing here, we have a court reporter here, and he is going to be making a transcript of this meeting. His name is Charles and he's sitting way in the back up there all by himself. And what I ask that you do is when you speak, speak slowly and clearly into the microphone, and give your name and your affiliation and he'll take it from there.

Because we're doing this with microphones, a couple other little hints. First of all, we need a clean record so we don't want to have any side conversations going that can garble our recording of this, so a little bit of, you know, manners there I guess is what I should say.

And when somebody is speaking, we want to make sure that everyone is heard here as much as possible, and we've got a handful of staff members here, and we live in this building, we're here all the time.

I would like to see if we could get our guests to be NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

9 able to speak first because they've come a long way to be here and they've had to go through extra screening and all that, and you can buttonhole somebody in the hallway and ask them a question. So let them ask first, and if you see a spot in there where I've got crickets going and I'm asking for questions, please feel free to add in something then.

I don't know if we're going to have a time length problem here. Primarily I say that we're going to need about three minutes to five minutes for your comments, but we have a very small crowd here so this may go a little bit quicker than normal. If I get to the point where I think you're getting a little bit long, what I'll probably do is get your attention and tap my watch and remind you that we have other people that want to speak.

Other than that, the last thing to mention is these microphones, consider them to be always be hot. We're not going to be discussing anything here that's proprietary, and although we intend to have an open dialogue, please take note that we will not discuss ongoing reviews and neither industry nor the NRC will be making any regulatory comments.

But if you're talking with somebody out NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

10 here in the audience and you happen to be talking about something that's proprietary or even semi-private, you really don't want it being broadcast around, so please be sensitive as to where the microphones are. And if you're going to talk about business, you know, probably the best thing to do would be to take it out into the hallway.

We're going to take one break here, and it's scheduled for 15 minutes, isn't it? I think we can still keep that. I don't think we're going to have a problem with time. Things have been going pretty smoothly. Are there any questions? I doubt there's any questions coming from the phone. Is that right, Melinda?

OPERATOR: No questions at this time.

MR. MUSSATTI: All right, thank you. So what I'm going to do is I'm going to turn the meeting over to Scott Flanders, NRC's deputy chief information officer in the Office of the Chief Information Officer, OCIO, and I'm going to let him handle the next bit of this meeting. Scott?

MR. FLANDERS: Thank you, Dan. Good afternoon. My name is Scott Flanders. I'm the deputy chief information officer as Dan stated, in the Office NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

11 of the Chief Information Officer. My office has the responsibility for implementing the CUI at the NRC.

On behalf of the NRC, I want to thank you for your attendance and participation in the meeting today.

We appreciate your time, and looking forward to the dialogue with you on CUI.

In addition to myself, there are several other NRC staff members and senior managers attending today's meeting who have been significantly involved with the development of the NRC CUI program as members of this CUI working group and steering committee. The working group and steering committee members represent the various NRC program offices and the NRC regional offices.

In the past, they Office of the Chief Information Officer provides status updates on CUI during NRC regulatory issues task for its public meetings. We've also participated in a couple of CUI public calls with NEI and industry representatives during the summer of 2018 to discuss our plans to transition to CUI.

One of our goals to support the NRC's transition to CUI is to minimize the impact of the transition to the NRC staff and our external NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

12 stakeholders. The NRC's CUI program is under development and we're several years away from implementation or from completing the implementation.

However, we recognize the importance of having an early dialogue with the NRC external stakeholders while we continue efforts to develop our CUI program.

Our plan today is to discuss the CUI program requirements as required by 32 CFR 2002, that's the CUI rule, and we plan to do that at a high level. We also plan to highlight some of the NRC's key implementation activities.

Today's meeting is intended to initiate an ongoing dialogue with external stakeholders to more fully understand the impact of potential NRC CUI implementation decisions on external stakeholders.

We plan to identify some key elements of the CUI program where the NRC could benefit from external stakeholder perspectives while we continue to develop the CUI program.

Since we're still developing the CUI program and haven't reached the final decisions, we may not be able to answer all the questions you have today. However, that doesn't mean you shouldn't ask those questions. From our perspective we'd like to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

13 just understand the questions and comments you have so that we can consider them as we continue to work on developing our program.

Following this meeting, we will be evaluating your comments and questions and recommendations that you provide today to support future discussions in a public forum. Before we begin, I'd like to have a quick introductions of the meeting participants at the table, and then after that I'll turn it over to John Moses who is our NRC senior agency official for additional remarks. You can just start.

MS. MENSAH: This is Tanya Mensah. I am the CUI program manager in the Office of the Chief Information Officer.

MR. MUSSATTI: Once again, I'm Dan Mussatti, I'm the facilitator for today.

MR. MOSES: My name is John Moses.

MR. ADLER: My name is James Adler, I'm an attorney with the NRC's Office of the General Counsel.

MR. MERTZ: My name is Nick Mertz. I'm also an attorney with the NRC's Office of the General Counsel.

MR. ERLANGER: Good afternoon, my name is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

14 Craig Erlanger, and I'm representing NRR.

MR. BARSTOW: Good afternoon, Jim Barstow.

I'm the licensing director with Exelon.

MR. MEYER: Good afternoon, Steve Meyer, functional area manager for STARS Alliance.

MS. STAIGER: I'm Maggie Staiger, NEI lead for CUI.

MR. FLANDERS: Okay, great. Thank you.

So at this time I'll just turn it over to John.

MR. MOSES: So good afternoon, and thanks everyone for coming. We really appreciate your time.

As Scott mentioned I am the NRC CUI senior agency official. In that role I am responsible for the oversight of the NRC's CUI program implementation, its compliance and its management. I'm also responsible for approving agency policies to implement the CUI program. To support my role on my right, I've designed Tanya Mensah as the CUI program manager, and she manages the day to day operations of the program.

In case you weren't aware, the CUI program was established by an executive order EO13555 on November 4th, 2010. The purpose of the program is to standardize the way federal agencies handle unclassified information that requires protection, and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

15 to promote information sharing among federal agencies, states, tribes, industry, academia, licensees and vendors. EO 13556, excuse me. Also, designated an executive agent, the National Archives and Records Administration to implement the CUI program and oversee agency actions to ensure compliance.

On September 14th, 2016, NARA promulgated a rulemaking that Scott referenced, 32 CFR 2002, to implement CUI. The rule establishes policies for designating, handling, controlling and decontrolling CUI. Specifically, the CUI rule describes minimum protections for physical and electronic environments marking, sharing and destruction.

At this point I would like to introduce Ms. Charlene Wallace and Mr. Edmond Lee from the National Archives and Records Administration sitting in the first row behind us in attendance as NRC guests.

Ms. Wallace is a management and program analyst in the Controlled Unclassified Information Office at the National Archives and Records Administration. Mr. Lee is an attorney advisor at the National Archives and Records Administration. They are here today to observe the meeting and learn more about the NRC's plans to implement CUI and also hear your comments and questions.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

16 As Scott mentioned, one of the NRC's goals is to minimize the impact of the transition of CUI for the NRC staff and for external stakeholders. In many cases, the implementation of CUI offers several approaches to compliance, and we would welcome your perspectives. For instance, entering into sharing agreements could be implemented at the organizational level or at the transactional level for that information.

In another case, different formats of information, whether paper or electronic, require different approaches to their protection. You may have a preference for the format of CUI for instance. Your comments, questions and recommendations on these aspects of CUI would be particularly welcome during the open discussion at today's public meeting and thereafter.

Before we begin our formal presentation, I'd like to welcome Ms. Maggie Staiger to provide introductory remarks on behalf of the Nuclear Energy Institute. Maggie?

MS. STAIGER: Thank you, John. This is Maggie Staiger from NEI. I am the lead for CUI project with NEI. The industry would like to thank the NRC NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

17 for hosting this discussion, and we appreciate your openness to our concerns and questions and feedback throughout the discussion.

We understand that CUI is driven through an executive order requiring NRC conformance. During the discussion today we'd like to reinforce the underlining reason for this directive was to create an open and uniform program throughout the executive branch.

The industry understands that to establish this uniform program, there is going to be some trickle down effects to industry through written agreements.

While the NRC is considering these written agreements, we'd like the NRC to focus on the understanding and the impact to minimize industry feedback, or minimize industry impacts. We look forward to this discussion and understanding the direction and impacts that the schedule of the CUI program is going to have. So thank you again.

MR. MOSES: Thank you very much. At this point I'd like to turn it over to Tanya Mensah to go through our presentation.

MS. MENSAH: Thank you, John. So this is Tanya Mensah again, I'm the CUI program manager. And NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

18 before we get started, I just wanted to remind everybody that there will be a meeting summary prepared following this meeting, and in there I will reference the transcript for the meeting as well, so that should hopefully help everybody in terms of tracking the discussion.

Also, if you're in the conference room and you have not picked up slides, they are on the door to the right by a table. So please make sure you get a copy. And for those who are on the phone, in the public meeting notice you should see a link to the presentation slides in the meeting notice if you haven't already looked at those.

So we're going to go to slide three. The agenda for today will be talking through just the CUI overview, and then there'll be questions and comments, so that'll be the open discussion portion of the meeting. And then we're also going to talk through after our break the NRC's plans to transition to CUI, and then we'll have another open opportunity for questions and comments.

And so you may have noticed that the presentation was structured so that there are a number of background slides. The fact that those slides are NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

19 in background does not minimize the importance of them.

That was not intended. The way we structured this presentation was so that we could focus on the areas of the program for CUI that we think industry might have the most interest in in terms of impacts. And so during our Q&A and open discussion any comments or questions on those background slides are also welcome, so I just wanted to emphasize that.

So we'll start at slide 5, what is CUI.

CUI is an information security reform that standardizes the way the federal government handles information that is classified but -- that is not classified but requires protection. The CUI program clarifies what to protect.

It defines safeguarding. It reinforces existing laws, regulations, and government-wide policies, and promotes authorized information sharing.

It replaces more than one hundred different agency policies and associated markings with one shared policy which is CUI. I'll be using the acronym throughout this meeting instead of saying controlled unclassified information.

It also standardizes markings for federal executive branch agencies. And so the repository for where those markings exist is in the CUI registry that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

20 NARA created and maintains for the executive branch agencies. It identifies all of the approved CUI categories, and that CUI registry is publicly available. And so there are some background slides that provide links to the location of the registry for anyone who's interested in looking at that.

CUI also directly applies to executive branch agencies that designate or handle CUI, and it indirectly applies through the written agreements or arrangements when we're sharing CUI with non-executive branch agencies. Non-executive branch recipients, sorry.

And so just as a reference, I included a footnote for the definition of, you know, what is a non-executive branch entity that comes directly for the rule. It includes elements of the Legislative or Judicial Branches of the federal government, state, interstate, tribal, or local government elements and private organizations. And there is some -- more language there, but I just wanted to point that out that we're all working from the same definition.

So John Moses touched on, you know, how the program was established through the order. Just a little background is that one of the important things NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

21 to remember I think is that the government already protects unclassified information. It's just that the effectiveness of the protection differ based upon each agency's unique program or requirements.

And so what was discovered was that those differences led to improper storage and inadvertent releases of unclassified information because there was no common framework for all the agencies to protect unclassified information. And also, agencies were overprotecting information so that the people who were authorized and needed to see the information may not have been given access to it.

And so CUI started after a Bush memorandum that was written as a result of an analysis that on the causes of 9/11. And one of the causes identified was uncertainty when determining if agencies could share unclassified information, and who it could be shared with because there were no information sharing agreements or arrangements.

And so what you'll see here in this diagram, it's just highlighting that the executive departments and agencies had their own ad hoc policies that were unique to their agencies. This led to this inefficient patchwork system with more than 100 different policies NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

22 and markings across the executive branch, and resulted in inconsistent markings and safeguarding of documents.

It led to unclear or unnecessarily restrictive dissemination policies. And also led to impediments to authorized information sharing.

And so the executive order as John mentioned, 13556, was established on November 4th, 2010. 32 CFR 2002 was published on September 14th, 2016, and this implements the CUI program. It describes how the government protects CUI.

The NARA CUI registry is a living catalog of the types of CUI. It describes what we protect.

And agencies are not authorized to create agency-specific categories. So all the categories that you see in that CUI registry are based upon law, regulation or government-wide policy, and that's what agencies are required to adhere to.

SUNSI, which is the Sensitive Unclassified Non-Safeguards Information, SUNSI is the NRC's program for how we protect unclassified information that requires either some specific handling controls or dissemination. It generally includes information that's proprietary, safety -- I mean security-related information. There's legal. There's allegations and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

23 other categories. A lot of those categories that we protect under SUNSI will transition to CUI because there are laws, regulations or government-wide policies that establish the authorities to protect those type of information. So you'll see that in the CUI registry.

In terms of public access to NRC information, the CUI program addresses how executive branch agencies will handle and share information for agency business purposes. It does not affect public rights to information under the Freedom of Information Act or the Privacy Act. And it does not require agencies to change their policy on public release of information.

So from our prior interactions that we've had with industry and the other public meetings and also during calls, we know that there are questions on how licensees will be impacted by the NRC's implementation of CUI based upon the fact that there are different options provided in the CUI rule, and that you've been wanting to understand for some time what we're thinking, just what we're thinking in terms of what we are considering.

And so one of the items that we want to highlight is that in terms of what the rule requires, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

24 CUI only includes information that the government creates or possesses, or that an entity creates or possesses on behalf of the government such as in the case of a contractor.

Licensees will only have to apply CUI controls to information that's received from the federal government pursuant to a written agreement or an arrangement. We have not yet decided the nature and the type of these agreements and arrangements.

Once we transition to CUI, official use only designations will no longer be used. In general, we think just based upon our discussions to date at the working group level that the majority of sensitive information or unclassified information that we currently share with licensees that's marked official use only will qualify as CUI and would be marked with a CUI compliant markings by the NRC. So you would see it change in terms of like what the marking looks like, and we'll talk about that later.

The CUI rule does not supersede or replace other laws, regulations, or government-wide policies which may impose their own control requirements, and so the example is 10 CFR Part 73 for SGI control safeguards information. Safeguards information is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

25 identified as a CUI category, a CUI specified because it has its own unique dissemination and controls for how you handle the safeguards in terms of marking, storage and destruction. So the CUI rule doesn't supersede those Part 73 requirements.

Licensees will continue to comply with the markings that are already specified in NRC regulations.

Examples include, for example, if you're familiar 10 CFR 2.390, or Part 73, there are instructions -- there is requirements in there for documents to be marked in a specific way. We are not anticipating at this time that those requirements will change. They will remain.

There are requirements for agencies when sharing CUI as you mentioned. Just to take a quick step back in terms of why the requirements are there, the CUI rule describes throughout the rule that the need to protect CUI does not decrease just because the information is being shared. And so it requires the agreements or arrangements when sharing CUI to protect it when it's shared with non-executive branch agencies.

The rule states that prior to disseminating or sharing CUI with a non-executive branch entity, agencies should, whenever feasible, enter into written NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

26 agreements or arrangements in which the recipient agrees to protect the information in accordance with the CUI rule.

One of the things -- and so I'm speaking just sharing from a working group perspective since you asked about what we're thinking and what we've been considering. So one thing we are aware of at a working group level is that we have a wide range of stakeholders throughout the NRC, and so we are thinking about how we may need to have different agreements or arrangements based upon those unique needs to minimize the burden of the different stakeholders.

So one of the things we're trying to obtain a better feel for is what type of arrangements or agreements might work best with different stakeholders.

So we are aware, we have received feedback in the past that one size fits all approach may not be appropriate.

So we're keeping that in mind as we go through and develop our program.

The rule also discusses that such an agreement or an arraignment may take any form, including but not limited to contracts, grants, licensees, certificates, memoranda of understanding/arrangement, or understanding, and information sharing agreements NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

27 or arrangements.

And so again, at a working group level, some of the things that we are trying to talk through are is there a way that we can leverage technology so that we could make this a more effective process when we're sharing CUI and also for the recipient when they receive it.

One of the examples that we've discussed is like, for example, the establishment perhaps of some type of portal that would allow us to share CUI where before the recipient can access the information, they have to accept some terms and conditions that say they're going to protect the information in accordance with the executive order, the rule, and the CUI registry and the laws that are referenced therein. It's this similar language that's already provided in the CUI rule but just putting it in the -- trying to incorporate it into whatever tool we use so that way it has to be accepted before the recipient can actually view the information.

There are also from our end, as John mentioned, questions we have about, well, do you need to only view it? Do you need to download it or print it perhaps to have a hard copy because if it's on your NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

28 system then that involves like information that's on a non-federal system, and so that calls into play some of the other requirements which we're going to get to NIST 800-171 in a moment. And so there is not uncertainty but we just have questions about how this fits into existing processes for the various stakeholders that we have.

We've talked about are there memoranda of understanding that we currently have that we can update?

Some agencies are doing that. If their primary means of establishing agreements was through MOUs, they're just updating those to incorporate the appropriate CUI language into that agreement. And so MOUs are not the only way, but certainly that concept could apply to other forms of agreements. And then we also thought about would it be easier to create agreements with specific organizations like for an entire fleet versus like having it attach to every document per say whether it's through a portal or having to somehow identify on each document this is CUI.

It will already identify it as CUI, but trying to incorporate that language about protecting it at an individual level or should it be at an organizational level. So we're trying to like consider NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

29 those things as well.

So that's just to give you an idea. We haven't made any decisions. But I think we're just trying to compare at this point what other agencies are doing. One of the things we're mindful of is that some of our stakeholders interact with more than one agency. And so you could be in a situation where you're receiving CUI from different agencies where we've implemented it using the different options, so you're seeing it like so you're seeing some variations there.

But also having to establish like written agreements with different agencies.

And so from our perspective even we'd like to coordinate with other federal agencies that we think our stakeholders deal with routinely to think about how we could streamline those agreements to minimize burden where feasible. But again, that's another thought.

So the final bullet talks about if an agreement with a particular non-executive branch entity is not feasible, but the agency's mission requires it to disseminate CUI to that entity, the agency much strongly encourage the recipient to protect CUI in accordance with the CUI rule.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

30 And the way that I've seen that implemented is that there might be a circumstance where an agency to support their mission needs to disseminate CUI, and they may not have an agreement established already with a particular entity. And so they strongly encourage using the requirements in the rule, and then follow up if that is a situation where they expect to continuously share CUI with that entity to actually establish the agreement or the arrangement.

So we'll move on to NIST Special Publication 800-171. You'll hear me just refer to it as 800-171. But NARA CUI rule identifies 800-171 as containing the security requirements for protecting CUI as confidentiality on non-federal information systems. The primary goal is to protect, again, the confidentiality of CUI information, and also to protect

-- to reduce the risk of data breaches that involve CUI that resides on a non-federal information system.

When non-executive branch entities are not using or operating an information system, or maintaining or collecting federal information on behalf of an agency, the agency is required through the rule to prescribe the requirements of NIST 800-171 in our written agreements or arrangements to protect the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

31 confidentiality of the CUI unless the agreement establishes higher security requirements.

And so there is a link there to the NIST 800-171 for those who are not familiar with this guidance -- I mean with this standard. You can go to NIST website and actually obtain a copy and review it.

And I just wanted to also mention that the 800-171 is incorporated by reference into the CUI rule.

For the Federal Acquisitions Regulations, so a lot of the information that the government protects is shared with contractors who protect or who perform work on behalf of the government. One of the options available to establish written agreements is through contracts, and so NARA has already coordinated revisions to the FAR rule for the entire executive branch to incorporate standard CUI language into government contracts.

And so the FAR rule ensures that there'll be uniform implementation of the requirements of the CUI program in contracts across the government. My understanding is that this will be issued for public comment and the latest milestone that I heard was sometime perhaps in the fall of 2019.

And so I'll turn it over to Dan and we can NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

32 take questions that you may have, or discuss any other topics related to the CUI program.

MR. MUSSATTI: Okay, thank you.

MS. MENSAH: Thank you.

MR. MUSSATTI: I'm going to open the floor up now to questions and comments. So if you have any questions, please queue up behind the microphones there, and I'd ask Melinda if you could begin getting people ready for us on the phone if they questions.

Do we have any questions at this time? Okay.

MS. WALLACE: Hi, my name is Charlene Wallace. I'm from ISOO. I just want to clarify just a couple things. You mentioned that agencies couldn't have specific CUI markings. You can. We have a CUI registry committee. All you have to do is submit a request for that. It goes through the committee process, then it goes up to our counsel. And from our counsel it either gets accepted or denied. And there is always a reason and you will always be told the whole steps that are going through.

And also you mentioned about your official use only marking. Those markings can stay within your agency. You'll have a legacy marking. And you can do a waiver. You can always do that, and we can talk NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

33 about that offline whenever you'd like.

But just to let you know that agencies and licensees or contractors, they're going to see legacy markings. Things are going to overlap throughout the years. So this is a phased-in implementation, so things are going to overlap for the next couple years.

So you're going to see -- you're going to see both kinds of markings, and that's why we strongly, strongly advise that you do a lot of awareness even though you don't have a policy yet which mean you can't have training yet. We can definitely do awareness. And we offer all that kind of information on our website that's downloadable. It's great reference tools. But I just wanted to just clarify those things. So thank you.

MR. MUSSATTI: Okay. Are there any other questions in this room? Yes, sir?

MR. NORMAN: Hi, my name's Rob Norman.

I work here at the NRC. You made reference to agencies being able to continue to use some legacy markings such as official use only. Is that exclusively for use internally, or are we free to disseminate that legacy marking to others outside of the agency?

MS. WALLACE: When I referenced the legacy NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

34 markings, what I meant by that is you will have to change them if that information goes outside of your agency.

If you share that information, it's got to have the CUI marking on it. But while it's within your agency, you can't still use that marking. You're still going to have to implement the CUI program. But you are going to see that.

But you don't have to remark anything because I know there's tons and tons of things that you just can't remark. And that's where your waiver's going to come in. But other than that, as long as it's here and it's a specific document that has a legacy marking on it, then you can continue to use it until it, you know, it goes outside of your agency.

MS. ROUNDTREE: I also have a question for you.

MS. WALLACE: Okay.

MS. ROUNDTREE: This is Amy Roundtree from the NRC. So you referenced being able to add something to the CUI registry, but in order to do that I think the premise is that you have to have a law, a regulation, or a government-wide policy to do that. So if we don't

-- if you don't have that you can't necessarily even start the process for adding something.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

35 MS. WALLACE: Exactly.

MS. ROUNDTREE: Okay, I just --

MS. WALLACE: That's exactly right.

MS. ROUNDTREE: -- wanted to make sure that we understood the premise behind that.

MS. WALLACE: Yeah, definitely.

MR. MUSSATTI: Okay.

MS. WALLACE: Did you have something to add?

MR. LEE: This is Edmund Lee from ISOO.

You can actually request a provision on category without having a law, regulation, or a government-wide policy.

But the fact that is you need to make a good faith effort that you will be making those law, regulations and government-wide policy. I just wanted to clarify that.

So even though you might not have it at this moment, if you can prove that you are making a good effort to make that law, regulations or government-wide policy, you can request that, and NARA can make that provisional category.

MR. MUSSATTI: Okay, any further clarifications here? All right. You have a question here? Okay.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

36 MR. BARSTOW: Yeah, Jim Barstow with Exelon. So maybe on slide 8, I don't know if we can go back to that. But one of the questions that we had in looking at the slide deck part of this meeting was some of the definitions I'd say are a little subjective.

So underneath the licensee handling of CUI, it talks about CUI includes only information the government creates or possesses. I somewhat understand the creation part, but the possesses part.

If a licensee sends in information, and recently we had the examples, you know, with the risk with the FSARs and making those public again. And there was, in an effort to look at the information that was being provided and whether it would fall under, you know, security sensitive or CUI, you know, wherever we were moving to, so we've given that to the NRC. Now does that become your possession, that information? And would it be controlled on your side as CUI?

MR. FLANDERS: So in that case when we talk about possession, so in the case that you described when that information comes in to us if we were fully implement -- in a position where we fully implemented our program we would have to mark that information that we possess consistent with the CUI marking NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

37 requirements.

However, since it's your organization's information and the rule actually, it's a statement of consideration, so the rule actually expressly speaks to this issue, that you would continue to handle it in the same manner you've always handled that information. So you wouldn't necessarily have to handle it consistent with, quote/unquote, the CUI rule or the requirements because it's your specific information.

We get in a situation where it becomes a responsibility of the licensees to handle the information, if it's information that we share with you that it fits in a CUI category that is information that is not your own or is not your own information that we provide to you, and then that information you would have to handle consistent with the requirements of the CUI rule. Does that --

MR. BARSTOW: Yeah, it does. But that was just one example.

MR. FLANDERS: Right.

MR. BARSTOW: I think we could probably come up with many other examples where --

MR. FLANDERS: Yeah, that's one of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

38 things that actually we've -- the working group has spent a fair amount of time on in looking at the various because we have the number of licensees, that the volume of CUI that we end up dealing with in this agency, we looked at a number of use cases and tried to think about, okay, what, in this particular use case how does the information have be handled internally, how does it have to be handled by the licensee. So we continue to work on that.

We want to make sure we think that through, and that's going to inform really how we implement our program. But there's been a fair amount of work on that particular area. We're continuing to work on that and talk through it first from the working group up to the steering committee to make sure that we think through those scenarios. And then as we get closer, really to be able to communicate very clearly to you guys in terms of what our plans are, get some feedback from you, and then also as before we get into that final stage so everyone fully understands how we would --

how we execute on those things.

MR. BARSTOW: Okay.

MR. FLANDERS: Yeah. Because there are a number of permutations just from a, you know, one NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

39 licensee group, maybe reactor group, then there's materials groups. So there's a number of different stakeholders with various information that we share.

MR. BARSTOW: Sure. Yeah. I mean one thing, I mean there's probably many examples that we come with. But I think through, you know, the license amendment process and something gets submitted that was created by us, then you review it, send it back through an SER to us.

MR. FLANDERS: That's --

MR. BARSTOW: And then all of a sudden now it's CUI and --

MR. FLANDERS: So that's one of the use cases we're looking at in terms of does that safety evaluation report, is it -- well, it has sensitive information in it, how much has that information changed? Is it still your information, you handle it that way? Or is it now changed sufficiently enough such that we would expect you to handle it differently?

Those are one of the use cases that we're really trying to think through. We actually had some good questions around the internal to the working group, trying to think that through in terms of how we better define it so we can give more clear guidance to you guys as NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

40 we move forward.

MR. BARSTOW: Okay.

MR. MEYERS: Steve Meyers, STARS Alliance.

Continuing with that thought, I think that's the perfect example of what really needs to be spelled out in the letters of agreement. You know, as I would see it that would be the case where it just wouldn't make sense to have anything but the licensees store it as they had because then we would have two different systems storing the same information, right? We would send it to you. Potentially it'd come back. You'd give us a letter of agreement, tell us to store it as CUI and we would have it as SRI.

MR. FLANDERS: Yeah, we understand.

That's one of the things we really want to think through to make sure that we -- as we said we wanted to try to do this in a way that minimizes unnecessary burden to everyone.

MR. MEYER: So just as a quick follow on to that, assuming we would work through with, you know, that outcome, I'm just trying to get a perspective.

I think from our discussions we're not seeing that there's a huge amount of information that the NRC would typically share with licensees that would be NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

41 categorized as CUI. Is that correct?

MR. FLANDERS: I'll start and then look to others and maybe other on the working group to jump in. That was my initial thinking as well. It really depends how we determine which information is truly licensee information and what's not. But that would be our general information, and then there are things that we do share with you that are not your information, whether it be security bulletins or things of that sort.

But the population of that first thought is similar to yours that it's not a whole lot. That would be different. But again, we want to make sure we think through it because we don't want to end up with a situation where we have something that we share with you that's unclear in terms of how you need to handle it. We want to try to be as clear as possible.

MR. MUSSATTI: Okay, one more question from the floor, and then I'll go to the telephones and see if we have anyone waiting there.

MR. LOMBARD: A quick follow on to Scott's response. Mark Lombard, deputy director, Office of Nuclear Security and Incident Response. Just keep in mind that if we receive information, a licensee member request and other information, we write SERs and other NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

42 documents, and we'll have to mark them in accords with our requirements. So you may get an SER that's marked CUI for example.

MR. FLANDERS: Right. And so you may get it marked that way, but again, the clarification we need to -- then handles once you receive it, we want to make sure you clearly understand and we clearly understand the expectation in terms of how you're expected to handle that, right? So we're going to have to mark it as CUI information.

But then it really gets into the heart of your question in terms of, okay, once you give this back to me and it's my information, and it's a safety evaluation report, then I handle it the same way I always have. Or is this information different enough that we declare not necessarily your information, now I have to handle it differently. That's one of the things we want to really make sure we kind of think through in some -- what kind of information we put in those safety evaluation reports. But as Mark said, it will be marked CUI. The question is what does that mean to you in terms of handling?

MR. BARSTOW: Jim Barstow with Exelon.

But that would be a case where you're sharing, right?

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

43 I mean that would fall into that process, right, and then there would be a memorandum of agreement or some type of agreement, right?

Now would we -- I mean do you anticipate

-- here is my thought. Looking forward into the future, I would see that happening with every licensee almost, or the potential to happen with every licensee. So do you anticipate needing a memorandum of agreement or some type of agreement with every licensee then?

I mean is that kind of where you're ending up?

MR. FLANDERS: So that was one of the items that Tanya talked about. So anyone we share information with by rule we need to have a written agreement. The question is what form does that written agreement take? The rule gives some flexibility, and so we're trying to figure out what is the most efficient way to comply with the rule in terms of establishing that written agreement with whomever we share the information with.

MR. MEYER: Steve Meyer, STARS Alliance.

When you talk about handling that information that you send back to us, and I'm not trying to word, you know, pick this apart, but is handling different than storing this information. Is it just the transmittal NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

44 or is it how we keep it once it's on site?

MR. FLANDERS: So it's both. It's the transmittal of it and how you store it whether it be in hard copy or in electronic form.

MR. MUSSATTI: Okay, Melinda, is there anybody on the phone that would like to speak?

OPERATOR: Thank you. Currently no questions, but once again, if you please press star one at this time to ask your phone questions.

MR. MUSSATTI: Okay. We're well ahead of schedule here. We're supposed to start the question and answer period in about 10 minutes. So we've got our time back. So any questions from the floor?

MS. MENSAH: This is Tanya Mensah, so I just was hoping if we could maybe just talk a little further since we have time. And one of the things that when we have our working group discussions and we're pondering these questions, and we don't actually have like representatives from industry in the room to say how do you do this, or what would be the impact if we were to make certain decisions or go this way or that way.

So I don't know if you've actually given any thought to -- you mentioned like having agreements NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

45 with each licensee. Would you like to talk further about impacts that you see in us doing that, and methods as far as if we were trying to establish written agreements with each licensee versus having something like a portal? Or do you have any insights that you could share with us?

MR. BARSTOW: Yeah, Jim Barstow with Exelon. Yeah, I'll start down the path and then maybe we can have other folks jump in. But one of the concerns I would have is that if -- I mean even if you have the agreement, I would say even before that, you know, the concern you end up with is that the information that I created and then provided to the NRC, and then received back as marked CUI is going to be information that I'm not currently controlling as CUI at on site.

And so now the challenge would be, okay, now I've got the information as CUI. I've got to do something with it in accordance with whatever agreement has been made. Now do I then have to go find that information where ever it exists and treat that information as CUI? Or do I keep two separate books?

Do I have one, as an example, you know, a final safety analysis report that's CUI and one that isn't, you know?

So you can see the dilemma there, you know, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

46 because once it's stamped and once I receive it, you know, kind of from what I've read, now I've got to control it, you know, handle it, however we're wording that, and store it in a special manner. So I think that's the broader question, you know, that we have to answer.

The agreements are going to be the agreements. I don't think there's, you know, I mean we have memorandums of understanding, you know, across the board, with a lot of aspects. But what we're going to have to do with that information once we receive it is going to be key. So, yeah.

MR. MEYER: Steve Meyer, STARS Alliance.

I do want to start off by saying thank you for the creative ideas, you know, the options that the NRC is looking at here first. And we really do appreciate that.

My main concern similar to Jim's would be especially in the area of safeguards information, it's very easy to receive a white finding because of, you know, mishandling that. And now we're talking about really having two parallel systems depending, you know, where the information originated from for really information that is of the very similar significance.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

47 And then the potential for employees in both, you know, fairly rarely handled information to make a mistake that, okay, well, now I've got, you know, CUI. Is it CUI specific? I've got SRI and safeguards. You know, where am I at? What document is this really and how do I control it?

And just does that make sense from the overall intent of protecting that information when it seems to me like you're opening more avenues for it to be inadvertently mishandled. So I'd ask you to think about that. I like the creativeness of, you know, the option potentially of some kind of an electronic portal handling that. I think in the end, though, on that while we're pursing, I think ultimately licensees will have some reason that they're going to need to take that information and copy it and process it, you know, just because it's efficient, right? So worth pursuing, but I don't -- can't give you any more on that for right now.

MR. BARSTOW: Jim Barstow with Exelon again. You know, we had the example I think that we saw when we tried to do the FSARs. You know, the one example there was we used maps of the site floors and, you know, the reactor buildings, that kind of thing NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

48 that we're -- they were fairly generic. But they did show vital equipment, not vital areas but, you know, where equipment would be. We don't treat those as, you know, any SUNSI or anything like that. In fact, they're given as handbooks to employees for, you know, when they come on site to be able to just navigate around the site. Yet, when we did the submittal in the FSARs, that information was redacted effectively.

So that's just an example of where we ended up with a disconnect between what would be treated as CUI and what we're treating as just general information for the employees.

MR. MOSES: Do you think -- this is an issue that we've discussed. Would indicating some kind of provenance of the information, in other words, if it were created by, let's say the licensee, we would have to control it as CUI? But if were shared back with you, you'd see it was the provenance because that's the dilemma we're talking about right now? Helpful, some kind of other way to indicate where it came from?

So if you get it, then you know, well, that's a document we provided to you with the information back to us so we control it the way we controlled it prior to sending it to you?

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

49 MR. BARSTOW: With a -- yeah, I understand that. I mean you're saying like another stamp or something that would say licensee generated. I mean I'm not sure what, you know, in some other designation.

Is that possibly?

MR. MOSES: I mean we're open to ideas and suggestions.

MR. BARSTOW: Yeah, it just seems like we're getting -- it's getting more complicated as we move along for something that's fairly simple. And then another question that came to mind while we were talking was is there -- I mean I'm sure there's going to be some, you know, review of how you're managing it on your side, inspection, the OIG, whatever, right?

How would that look on our side? Like would there be inspections on our side of how we're handling CUI once we receive it? You know, would the memorandum of agreement be a trigger for then, you know, some inspections or audits, or --

MS. MENSAH: So this is Tanya Mensah. The only guidance I've seen on inspections is in a CUI notice. And so NARA issues CUI notices. They're similar to like how we issue information notices. But it sometimes provides like clarifying information for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

50 agencies in terms of how to implement the CUI rule.

And I can't recall the notice number right now, but it may pertain to written agreements, but there is a section in there that talks about when establishing programs that the recipient let's say that you at your end or your licensee discover, oh, this was CUI. It was shared with us from an agency and we failed to protect it somehow in accordance with the law.

So right now the language speaks to that recipient self-reporting to the agency that disseminated the information to them, and it says reporting to the CUI senior agency official, who in our case would be John Moses.

So we haven't reached the point yet of trying to think or talk through how that process will look in terms of like, well, what does that reporting mechanism look like? I don't know that we've reached the point where we've thought about or decided that there should be inspections and how we would perform those. So that's still something that we need to work towards understanding more.

MR. MOSES: Would NARA care to comment on that question?

MS. WALLACE: This is Charlene Wallace NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

51 from ISOO. Yeah, I was just looking over all of our notices, and you can see all our notices in our CUI website. They are plain and simple. It's CUI notices.

So I was looking over my list and we have a couple 2018-03 as an implementation and compliance reporting and delays. That's one you can look into. And it's also a 2018-, I do believe 02 which is recommendations for CUI basic training. And then there are 2018-01, it's guidance for drafting agreements with non-executive branch entities. Yeah, I think that's the one you were thinking of, too. So, yeah, those are the ones you could possibly look at to maybe help.

MR. MOSES: Thank you.

MS. WALLACE: Okay, just making sure.

MR. MUSSATTI: Okay, I'm going to go back to the phones now just to make sure that we don't forget about our folks up there.

OPERATOR: Thank you. We have no phone questions at this time.

MR. MUSSATTI: Okay. Back to the room.

MR. MEYER: I forgot who it was that mentioned grandfathering information, I think it was Charlene. Steve Meyer, STARS Alliance. I'm a little bit confused now that I'm reflecting back on everything NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

52 we've said on that because I think it was in terms of licensees could -- the information was stored as like safeguards information, et cetera, could be grandfathered. But is that really even applicable since that's all the information we created? It shouldn't even apply, right?

MR. MOSES: So just to clarify, safeguards information is a specific type of CUI. So the controls would continue and convey, and I'll turn to NARA in a moment. In terms of grandfathering or legacy information, that's for, let's say, OUO has labeled that is not SGI or other specified or types, so there may be cases. So for agencies, they wouldn't have to go through and relabel legacy documents or electronic information. They could waive that. But then as their

-- exchange that externally, then they'd have to be properly labeled and designated.

MR. ADLER: Yeah, just to -- a licensee's own SGI that it generated, especially if it's not given to an agency and created, or any of those complicated issues, it just means SGI doesn't become CUI simply because of the CUI program being implemented at the NRC as it's still just a licensee's information and maybe the government doesn't even possess it all.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

53 MR. MEYER: Okay, thanks for the follow up there. And then as an additional question when you said for example sharing SGI with the NRC. Since we're sharing it that direction versus the NRC sharing CUI back with us, we would not need to necessarily send it as -- or transmit it as CUI? Or would the letter of agreement address all of that then?

MR. ADLER: Yeah, I mean the -- well, the protections might not change much if at all because of Part 73, you know, still continuing to apply and it being a CUI-specified category of information because Part 73 has some different requirements than the CUI rule. And the NRC would have to mark it as CUI-specified SGI when we get it. It doesn't convert it to CUI, you know, it doesn't convert your versions that you're keeping in your files into CUI.

The complicated issues would be then if we share something back to you that has some of your SGI in it, and we created a new document and we have to make sure, you know, is there some CUI here that isn't actually yours such that you have to treat it as CUI because of that. And then if so, how do we convey that? And what do we do with the CUI marking that we put on it and that sort of thing which are the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

54 troublesome issues we're trying to work through.

MR. FLANDERS: But just to add, I think your question is when you send it us, do you have to do any unique markings beyond what you currently do for safeguards? I think the answer to that right now is no. Yeah.

MR. MEYER: Okay. That's really what I was getting at as we talked about. I know I started with legacy, but with any category, safeguards and then CUI in general, the way I see it is the sharing agreement is a one way from NRC to us. Whatever we send to you, we owned it, so it's excluded. Okay, thank you.

MR. MUSSATTI: Okay. Do you have something you wanted to add?

MS. WALLACE: Yeah, if I could just add upon that. That was so spot on. You have to remember who the originator is. If you're the originator and you send it to the NRC, you don't have to mark it.

They'll mark it. But you're the originator so it's your document, and it will always go back to however you protect that information. So I just wanted to just clarify that. Everything was exactly right. So, yeah.

MR. MUSSATTI: Okay. More comments from NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

55 the floor here? You have one?

MR. NORMAN: This is Rob Norman again, NRC.

Backtracking a minute when we were talking about inspections as it relates to CUI. As SGI is a part of the CUI program, the inspections that you may receive will not be because it is CUI. It will be because it is SGI. And the NRC has inspection procedures for SGI that you will still be subject to after the implementation of the CUI within the NRC.

MR. MUSSATTI: Okay. A follow up on that?

Do you have a question, comment?

MR. STAPLETON: Yes, sir. Bern Stapleton with the NRC. One of the standards of information protection is that the information is protected at the same level no matter who has it. And we do have this dilemma here that's being pointed out that our licensees will protect it at a level that it's less than the CUI protections that the NRC will have until such time that they actually send it to us. So you have the same amount of information being protected at different levels.

That's something that's the NRC is very unique.

Department of Energy has contractors doing work on behalf of the government. They all treat it the same. We have independent, non-government NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

56 entities. So there is a real disconnect in that sense.

I wonder with the exception perhaps of safeguards information, would the NRC cite the licensees for failure to protect CUI unless perhaps it's spelled out in these letters of agreement? How would that occur, or can that occur?

MR. ADLER: I see people looking at me.

All right, I mean I think that's one of the issues we're trying to figure out, and as was mentioned what the

-- that the CUI rule says something about it and there are notices say something about it. There is a notion of -- on executive branch entities reporting issues.

But, you know, the CUI rule doesn't get into, and therefore, you know, if there is an issue, this is the penalty.

There may be something like, you know, an NRC regulations relating to safeguards information that would have something to say about that for safeguards information. But for CUI generally, that's not something that NARA or the CUI rule has directly addressed at this point. So we don't have a direct roadmap for how to implement that.

MR. STAPLETON: That could present problems down the line then. It is possible perhaps NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

57 the NRC, you know, in the classified world you'll see a lot of times this document is classified with the exception of the cover letter. Once the cover letter is removed, the document is no longer protected.

We could perhaps, you know, take a licensee's security procedures, and let's say it comes to us. It's not marked as CUI. It's marked as 2.390.

We then have requests for additional information which more than likely we would consider CUI. But we don't mark up their document. We do like a separate addendum so that their document remains non-CUI. It remains 2.390. And it would -- perhaps the cover sheet would say CUI, but it would say upon separation of the NRC comments related to this document, licensee document remains 2.390, not CUI because you wouldn't have the two together. But that's a potential approach. Thank you.

MS. STAIGER: This is Maggie Staiger.

With regard to 2.390 and Part 73, COMSECY 18-22 had mentioned this might be -- these portions might be revised. Are you still looking at that, or no more?

MR. FLANDERS: We are still looking at that. We're actually continuing to work on the rulemaking activities towards that. Primarily right NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

58 now, and I guess I can kind of give you a sense of the scope of that, but we are continuing to look at that rulemaking activities right now.

MS. MENSAH: Right. So we are considering nomenclature changes primarily, like in areas or sections of our regulations where it specifically talks to sensitive unclassified information changing to controlled unclassified. So right now the only changes we've identified that would be applicable and consistent with NARA's guidance are the nomenclature changes.

So we're not -- or you're probably referring to the marking changes that say -- so NARA'S guidance is clear that if there is an existing authority already established through a law, or regulation, or a government-wide policy that says, for example, here's how you have to mark this document. You have to write safeguards information here at the top and the bottom.

That those governing authorities still apply.

So we're not changing those authorities because what would happen is when you submit the document to us we would just follow Nara's guidance, and we would apply the CUI compliant marking in the banner above the marking that's specified. So that's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

59 how the guidance currently works. Based upon that, we haven't identified a need to make further changes beyond just strict nomenclature changes.

MR. MUSSATTI: Okay, around the room again. And Melinda, do we have anyone on the phones?

OPERATOR: We do have one question. Pat Asendorf, your line is open.

MR. ASENDORF: Thank you. This is Pat Asendorf with Tennessee Valley Authority. I apologize, I may have missed part of the conversation with my colleague Steve Meyer there regarding the historical when we were being transferred on the line.

So we do have quite a bit of OUO currently in a variety of documents, and these may be in guidance documents from the NRC, inspection reports. So my understanding is that those historical documents will continue to be OUO but not be handled under the new CUI. However, if the NRC reissues that document it would then be CUI.

So we have those documents now. My comment and question go more to the inspection reports that are under OUO. Sometimes there are safeguards, understand how they handle that. But is the NRC considering portion marking CUI so it's clear as to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

60 what specifically in the document is CUI? And the reason I ask that is we as an industry share a lot of that information from an operating experience standpoint, and if it's not truly CUI we would prefer to be able to share that openly rather than under CUI controls.

And then how would it work if it were CUI for us to share it with our industry peers, our inspection report finding or information that's been designated as CUI if there is no agreement between us?

MR. MUSSATTI: Okay, don't go away in case you've got a follow-up question here, but is there a response from the table here?

MR. MOSES: So portion marking is one of the areas that we're considering for different aspects of CUI. So that's certainly there. In terms of the second question, I don't know if I have a response, but we'll take a look at it and get back to the public and industry as we come up with a response.

MR. FLANDERS: So just -- TVA is a unique entity, and I'm just trying to think through. Does the rule extend -- does the CUI rule extend to TVA?

Or is it not considered to be within the scope of --

PARTICIPANT: But it's a non-executive NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

61 branch.

MR. FLANDERS: Non-executive branch agency, so it wouldn't extend to them. So they wouldn't necessarily have the same requirements to establish agreements with whomever they send it to. So your question is really more of a third party sharing of information which is something we would need to think about as we develop those agreements.

MR. ASENDORF: Yeah, so my question was, yeah, for TVA, but also for this nuclear power reactor industry and sharing operating experience, those are that are not under the executive branch agencies.

MR. MOSES: Yeah, I mean --

MR. FLANDERS: So really the question is what is the written agreement or what's the guidance in terms of third party sharing?

MR. MOSES: Yeah.

MR. FLANDERS: That's a good thought that we should would take into consideration.

MR. BARSTOW: Isn't that a -- that's a very general question. I mean I don't think it just -- it's not the nuclear industry, although we, you know, do that quite a bit. But I mean it's more of a general question for how the, you know, what rules govern that.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

62 MR. ASENDORF: Fine.

MS. WALLACE: I was just thinking that's one question I'm going to have to mull over. That's a good question. So as soon as we conclude this and we get the transcript and stuff, we'll definitely look into that and get back to everybody.

MR. ASENDORF: Thank you.

MR. MUSSATTI: Okay. Is there anybody else on the phone?

OPERATOR: No further phone questions.

MR. MUSSATTI: Okay. Back to the floor.

MR. MOSES: So if I could pose a question, and it's indirectly related to the last discussion.

We've discussed internally that there may be cases where external parties or licensees and others may have several agreements with multiple federal agencies.

If that's the case what are your thoughts on standardizing agreements or keeping them specific for the agencies?

MR. BARSTOW: I'm trying to think of what the examples would be. You know, one example could be, I know we've got agreements -- the sites have agreements with local, you know, police, local fire departments, that kind of thing where we share NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

63 information. We bring then on site, you know, expose them to, you know, information, you know, maps, fire plans, you know, that kind of thing.

Those agreements are there. They could be modified, you know, once we determine what modifications are appropriate. I mean it's possible, it's doable. I mean but, you know, once again, I'm not sure it makes sense, though, because the information

-- I mean we're, you know, a broader topic I guess, but, you know, the information that we're talking about has been shared repeatedly over, you know, many, many years and we really don't have an idea of where it's even gone because it hasn't been controlled. And then one day we're going to say, okay, now it's controlled.

And, you know, people are going to be walking around.

They're going to have, you know, these books that we give out at their homes and, you know?

And there's no way to collect that information back. There's no way to really say that it's going to be controlled in the future other than, you know, we have one example where, you know, we've received something back from the NRC that says, okay, now this is controlled and that one document is controlled, and we put that off to the side and we kind NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

64 of ignore all the other information around it.

So that came back to your comment about the agreements, I'm not sure that would really I think confuse the folks that we're trying to ask to help us.

You know, we'll say to them, yeah, we need you to control this this way now, and they're going to be in the same positon as well. I don't know where all that information is that you gave me before, so. That's a thought.

MR. MEYER: Steve Meyer, STARS Alliance, and I don't think I have a lot to add to Jim's perspective on, you know, is there an advantage one way or another with the letters of agreement trying to consolidate that or something. I'm not sure how big of a problem I really see that being for the NRC or licensees for that matter. But I think Jim's perspective is one we really hadn't talked about that maybe more of concern is, you know, that emergency response procedures, those things that are out there that we would need to share quickly with the right people that, you know, does it

-- things that we share already, is there going to be an impact there?

You know, I really don't know. I guess potentially there could be depending how we end up with NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

65 the position on like drawings, et cetera. But most of that we created, so maybe it's not a problem. I think it's just -- I want to say I think it's just something that's a good perspective we need to think more about.

MR. MUSSATTI: Okay. We've got about 10 more minutes and then we're exactly on the agenda schedule. This has been a great discussion. It's, you know, brought some new things to light. Let's go along as we need to more.

MR. MEYER: Steve Meyer, STARS Alliance.

After all this discussion I'd like to go back, I think it was to Jim's first question and re-ask where does the line cross -- what are you seeing as where the line crosses to NRC possesses, you know, in the definition of what's controlled unclassified information?

MR. FLANDERS: So I think back to Steve's

-- the first question with regard to sharing of information, you send the information to us, we send you a safety evaluation report back.

MR. MEYER: Sorry, I'm referring to the definition or the definition of CUI. It's information that the NRC, the agency possesses is the word I'm really looking at there. So back to information that's shared NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

66 with you or otherwise provided, where does that circle get drawn for where -- at the point you possess it versus maybe it's just transmitted to you. And is there a difference? I don't know.

MR. FLANDERS: So I look to our attorney for clear guidance. But my initial thought is that any information that we're in possession of, we have to make it -- and it's CUI, we have to handle it consistent with those requirements. That would be the burden on the agency. I don't know if that's a different --

MR. ADLER: Are there any particular scenarios you're thinking of? I mean, you know, in general if a licensee gives the NRC information without anything more happening, we need to worry about protecting as CUI, but the licensee is not going to have to worry about that.

MR. MEYERS: Great.

MR. ADLER: But maybe there are some particular scenarios where there's some sort of temporary possession by the NRC or something, is that what you could have --

MR. FLANDERS: Yes, I could think of at least one case, just as you were talking James, I could NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

67 think of at least maybe one case. Maybe it's a situation -- we're in an audit situation, you share some information with us. Or an inspection activity where we're at the site in terms of how we specifically have to handle that information. And maybe that's something we need to think about in terms of guidance.

MR. MEYER: Yeah, the question is obviously going down that path of at what point does the information that licensee's create and transition over to information you possess? Is it after so many hours, or -- you know, because that's a great example, supporting inspections and typically I wouldn't think of that as information really in your -- that you're possessing. It's information we created provided for you to look at.

MR. BARSTOW: Yeah, Jim Barstow with Exelon. It almost feels like it's -- we follow the FOIA rules, you know, where it's like -- because that's when your -- when it becomes FOIA-able that's when you possess it. You know, so if you use that same logic.

MS. MENSAH: This is Tanya Mensah. So just to follow up on that, so I know like I was aware that are certain programs we have here at the agency where like our staff will go out for audits, you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

68 mentioned audits. Like I'll just pick on licensee renewal for example. So because of the volume of information that exists on site, the staff go there to perform the audit and look at whatever information, and then they come back without actually taking possession of that information. They just document that they were there, that they actually viewed it or they actually saw something.

And so I don't know if that's maybe a scenario that we would talk through because I know that we're not actually asking licensees to submit it to the NRC because we're going there and we're just doing a report to say this is what we saw. Whatever we have to check or look at, they verify it on site. And then use that input for their safety evaluations.

So that might be a case where -- like we were talking through how to handle licensee information, that's your information, CUIs because you're submitting it to the agency, we're protecting it as such. But also I think if it's CUI, it's already based upon the fact that there is some existing law or regulation in place that says that this is a type of information that needs to be protected in some manner so I think it's still being protected, it's just not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

69

-- you're just not labeling it as CUI. Is that correct, James, or --

MR. ADLER: Well, I mean I think this --

MS. MENSAH: Like it's not like they're not doing anything. There are certain laws that --

MR. ADLER: That depends. I mean there are -- a lot of the laws and regulations, and government-wide policies are talking to the government.

They're not necessarily talking to non-executive branch entities. Some do, like our Part 73 regulations. But a lot of them don't. So I mean I think on the -- if we're talking about this issue of, you know, when NRC auditors or inspectors come to a facility and are, you know, looking at information at the facility, and leave it there and go away, and then, you know, write some report, you know, the report or the notes that are created potentially by the inspectors that they take away, I mean that -- if there is CUI in there, it, you know, would need to be handled according to CUI requirements by the inspectors and the agency.

I mean I sense -- and we have some NARA representatives here, so they could -- they're welcome to chime in. But the CUI rule doesn't appear to have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

70 been designed to contemplate, to, you know, a federal auditor coming to a private facility, you know, picking up a piece of paper, looking at it and putting it down, and having to, like, you know, have a stamp, a CUI stamp, mark it, and then fix up the environment so that there are physical barriers in place and all the things that apply in like a workplace situation in the government, where you have CUI.

So I suspect -- I mean there's a concern for the NRC inspectors or auditors that they make sure information they take back is appropriately handled, but I doubt it's going to -- it goes so far as to mean that the information has to be controlled as CUI because an auditor looked at it and then put it -- and then gave it back to the licensee at the licensee's facility.

MR. FLANDERS: Yeah, so I agree 100 percent with what James saying. I think our audits and sometimes inspection activities and what information we may have on some temporary basis, it's differs, right? So there's a situation where you just look at it on the site and it that's pretty straight forward.

But then there -- I know other audit situations where it's not quite that simplistic in terms of how the NRC's access to the information. And so we just need to think NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

71 about that in terms of our business practices and making sure we give the right guidance to our staff in terms of -- that's a good question.

MR. MEYER: And I just want to add, Steve Meyer, again, STARS Alliance. I just wanted to add on to the end of that that that was a good example of what I was speaking to. And I think also a little bit more generally, and going back to the discussion of, you know, how do you treat this stuff that's going back and forth? The reason is when I read the definitions of what is and what is not CUI, the word possesses appears in both.

So it's like, well, do you both possess the same information? So that gets back to if we send you something and who owned it first kind of a thing.

But then if you store it and you possess and we have it, but the definition would say that, you know, we both can't, I guess, own it at the same time the way I read it, maybe we can. But I think that's for your team to figure out as far as making it CUI.

MR. FLANDERS: Yes. I would look to NARA for that -- I think that the possession, at least as I was interpreting the rules, really if it's in our hands and make sure we control it appropriately as NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

72 opposed to like who is the co-owner of the information.

But the fact that we are handling it, that we show that we protect it. I think that's kind of how I interpret it but I would look to them. But it's a good clarifying question that we'll -- something we'll think about as we think through our implementation.

MR. BARSTOW: Jim Barstow with Exelon again. I appreciate -- I agree with you. We would not probably want to get into a situation where stamping everything that touches our hands, right? But, you know, we're talking about submittals, which is a very formal process, and, you know, bounded pretty solidly.

But the residents every day have information flowing through them through, you know, electronic means and, you know, looking at IRs, and, you know, I go back to the out book (phonetic) just because it's such an easy example. But, you know, there's a whole bunch of information in there about phone numbers and where to call control points and different things like that.

So they could be sitting there with a book in their pocket, you know, somebody could certainly make a case that that's possession if they've have it for, you know, a month at a time or something while the, you know, the sites in an audit. So it's just NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

73 something to consider about how -- your business practices, right.

MR. FLANDERS: This is a great conversation. I think the -- and again, we talked about this earlier, what we wanted to do is make sure that we are implementing the rule, and certainly in compliance but in the common sense way, and in a way that minimizes the burden. And so these are types of

-- some of the types of clarifying questions that we need to make sure that we have for folks so that we can implement in an effective way that's not unnecessarily burdensome and it has, you know, a level of common sense in terms of what we're doing.

MR. MEYER: If I could, Steve Meyer, I'd like to ask a question about any -- what you've learned so far on your NIST 800-171 review of systems. So we can understand more and maybe what we could expect.

MS. LYONS-BURKE: Hi, this is Kathy Lyons-Burke from the NRC. Could you please repeat your question? I'm trying to understand exactly what you're asking about 171.

MR. MEYER: Sure, Kathy. What I'm asking is from your review of the NIST 800-171 requirements for the IT systems that handle CUI, what have you learned NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

74 about that that, you know, we should be aware of? And maybe things that you weren't expecting or surprised when you were reviewed your systems and communications protocol, things like that.

MS. LYONS-BURKE: Okay, let me clarify one thing. We as a government entity are required to follow FISMA. We do not follow 171, right? So 171 is a subset of the requirements that FISMA requires. So we have more stringent requirements that we have to apply to our systems.

So 171 is just addressing the confidentiality requirements. It doesn't address availability or integrity requirements. So what they did was they took what they felt were the most applicable requirements and put it into that document as opposed to the full set that FISMA requires. Is that kind of what you're asking?

MR. MEYERS: That certainly helps me understand those two. What I was really wanting to get a read on is do you anticipate there will be any significant changes when licensees are required to comply with this in the handling of CUI?

MS. LYONS-BURKE: I'm not familiar with what licensees have implemented, so it's a little hard NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

75 for me to address that question in full. I expect that it will have more stringent requirements than maybe you have implemented. But without understanding what you have done, I can't answer what the differences would be.

MR. MUSSATTI: Okay, one last time going to the phones.

OPERATOR: We have no questions.

MR. MUSSATTI: Okay. It's quarter till three. Do we want to continue this or do you want to stick to the agenda? Okay, well, let's begin our break at this time and come back at three o'clock according to the clock over here, and please remember that it's a long ways down to the coffee room and back again, and we would be really appreciative if you didn't get a coffee unless it was a real little one you could drink in the break time. I'll see you in about 15 minutes.

(Whereupon, the above-entitled matter went off the record at 2:46 p.m. and resumed at 3:01 p.m.)

MR. MUSSATTI: Okay, everybody. Welcome back. I'm dinging. I should not be doing that. I thought I just shut this off. Which reminds me, it's time for everybody to shut off their cell phones again.

Yep, that was on airplane mode. It shouldn't have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

76 done that. Okay, once all the phones are back off, I'm going to turn the meeting back over to the people that know what they're talking about. So who's speaking next? You're back again? Okay.

MS. MENSAH: Okay, so this is Tanya Mensah, and we're going to begin the second portion of this meeting to talk more specifically about what the NRC is doing currently to transition to CUI. So we'll go to Slide 14.

And so the CUI program will be implemented at the NRC through the NRC CUI senior agency official who is currently John Moses. The CUI, and refer to them as the SAO, ensures that the agency has sufficient policies and guidance in place for NRC staff and contractors that handle unclassified information.

We talked about how CUI will eventually replace the NRC's sensitive unclassified non-safeguards information program which we refer to as SUNSI. And that it will include safeguards information and SGI modified handling because these are CUI categories, though all of the controls identified for SGI that are codified in NRC regulations remain in effect.

As the NRC transitions through the various NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

77 stages of implementation, our goal is to communicate pertinent information to NRC staff, contractors, as well as our external stakeholders. Slide 15, so this shows the near-term activities that we're working towards, and I'll go through each of these bullets.

Just wanted to point out that in terms of timelines, though, each agency has a different schedule in terms of when they will transition to CUI. So there is no one date where all agencies will be transitioned.

What normally happens is that each agency reports their status to NARA. We have like an annual report that we fill out, usually around the August to November timeframe, and then NARA looks at that. And so they know like what the implementation status is for each agency and where we are in our process.

In terms of the NRC for fiscal year 2021, we're looking at the first two bullets, speak to the NRC CUI policy statement and the management directive.

And so the policy statement is an externally-facing document meaning that it's, you know, really to inform the public that the NRC plans to transition to CUI at some point, and that our goal is to minimize the impact on our staff as well as our stakeholders. But that we are going to be consistent with the requirements NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

78 in the CUI rule.

It's very high level. The commission approved us to publish that as a final policy statement concurrent with the issuance of management directive 12.6 which is guidance for NRC staff as well as our contractors to follow. It will provide guidance for staff to implement the CUI program at the NRC. So those are anticipated right now. We think that they'll be published in fiscal year 2021.

Following that, we're going to be working also to update our own NRC internal guidance and office procedures, so like there are a number other management directives and office procedures that reference SUNSI.

And so those will have to be revised accordingly to reflect CUI, and so we'll be working towards that.

We'll be developing training for NRC staff and contractors as well so that should also say contractors.

It's not just for staff because if we have contractors, they have to know how to handle the CUI.

And then we'll be working towards a method for establishing the written agreements and arrangements, and so we expect further dialogue and communication as we attempt to align for the various stakeholders what we are proposing so that we can get NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

79 feedback on it before we decide to implement.

The next bullet speaks to proceeding with the CUI rulemaking, and so we talked earlier about how that rulemaking, the Commission approved us, the staff to commence a CUI rulemaking to support the NRC's transition to CUI. That transition, the rulemaking right now that the staff is considering is nomenclature changes, again, just to align and identify changes in the regulation to switch from sensitive unclassified information to controlled unclassified information.

And so right now that's the plan for the CUI rulemaking.

And then of course, there'll be a number of activities and communications to inform the staff and external stakeholders of the NRC's transition to CUI. So it won't just be just suddenly like, hey, tomorrow we're transitioning. There'll be a plan to make sure that we're keeping everybody, internal as well as external, aware of like the plans to transition and what the dates are.

Areas for future engagement, and so I know the list looks long, but there's a lot actually in those two bullets in terms of how to establish written agreements and arrangements. And also NIST 800-171, that was really just something in terms of us having NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

80 a further understanding of what the requirements are there and the impacts to licensees.

There may be other topics. I know we discussed a number of issues here. And so we're going to be adding those to the list so that we can track them and include them as discussion topics for the working group and the steering committee as well. So we appreciate your input today.

And the last slide was just how can you obtain additional information. And so I know Charlene Wallace mentioned it to you, but NARA has a CUI website.

It has a lot of good information up there. The CUI registry is there. They have all the policy and guidance. They have training videos so you can see for like -- you can see an overview, you can see training videos on marking, on decontrolling, on FOIA. There are, you know, there are lots of different modules up there that are accessible.

I would recommend even like making sure you have access to the CUI blog because through that they send out notifications when they are considering new guidance, or draft documents that are going to be issued as CUI notices. You'll be informed of meetings that are coming up.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

81 The next bullet shows the CUI program update. I believe that's a quarterly meeting, but it's open to anybody. And so on the ones that I've participated or called into, NARA provides a general overview of where things are in terms of CUI implementation, and they also address questions. They have a fair amount of time there for questions. And so agencies usually call in to ask questions. I've heard contractors on the phones, you know, asking questions about what the expectation is for them to do to meet certain requirements. So I recommend following those meetings.

Of course, the NRC, you know, we anticipate that we'll have future discussions. We don't have a periodicity in terms of like they're going to be every three months, or every six months. I think that we just will probably need to evaluate where we are in our process and figure out is now a good time for us to go back and engage further. But certainly if there are topics that you want to discuss, you can always recommend them to us or, you know, if you think you what to have a meeting.

We recently created the NRC CUI public website, and that's to keep our external stakeholders NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

82 aware of where we are in terms of CUI implementation.

A lot of the information up there is high-level. It points to the NARA website as references, but it also lists some of the documents that we've developed, SECY papers, so that someone can follow like what we're proposing and where we are in our process.

And then of course we have an e-mail established, cuinrc.gov, where anybody can e-mail that and it will direct e-mails to John Moses and myself so that we can respond and answer questions. So those are all the different ways that you can obtain additional information. And we are back to another break, or another Q&A period. So I will turn it over to Dan incase there are any questions.

MR. MUSSATTI: Okay, Tanya. Thank you very much. Once again, I'm going to open the floor up for the dialogue like we had the last time. And Melinda, if you could start queuing folks up on the phone for us, please, I'll be coming to you in a few minutes. We have a comment here?

MR. STAPLETON: Yes, Bern Stapleton, NRC.

We mention in the NRC rulemaking that from a nomenclature standpoint we're going to take sensitive of unclassified information and essentially convert NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

83 it to controlled unclassified information? Does that mean that everything that is currently listed in 2.390 would become CUI?

MS. MENSAH: So the plan for 2.390 it has like specific marking instructions. It's still proprietary, but when it comes in the staff would have to access if it qualifies for CUI under proprietary because that is an actual category in the CUI registry.

I think it's call business proprietary.

MR. STAPLETON: Right.

MS. MENSAH: So once the staff determines, yes, this is, we agree this is proprietary, we would apply the CUI marking. There is a specific marking that would be applied in the banner for that.

MR. STAPLETON: That's a fairly fundamental change from the way it's currently done.

That right now the licensees will actually make the decision to mark 2.390. So the originator has that responsibility for designation which is similar to safeguards information, similar to classified information, et cetera. Under this, if I understand it correctly, you're asking them to submit information

-- well, you're basically asking them to mark it CUI before they send it to the NRC.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

84 MS. MENSAH: No. We are asking them to use the current language that's in 2.390 that says they can mark it. I think you can put proprietary or withhold, or there are different options I think in there. They still mark it the exact same way. The difference is that they won't be applying the CUI, like the banner format is like CUI, two forward slashes.

MR. STAPLETON: Right.

MS. MENSAH: And then it would be PRO-PIN I believe, it's like P-R-O P-I-N would be the category that would normally be placed there. But we are going to have the burden as the staff to put that marking in the document, not the licensee. So we're not asking them to put anything in the document that says this is CUI.

MR. STAPLETON: But they'll do the current way they do it now, 2.390 protection?

MS. MENSAH: Exactly. So there's no change.

MR. STAPLETON: We will look at it and then we may essentially upgrade it from that.

MS. MENSAH: So if we determine that, yes, this does qualify, this is -- that they've identified it as proprietary and we agree with that, and we're NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

85 going to apply the CUI marking above in the banner marking. That would be the process to be consistent with NARA'S CUI rule.

MR. STAPLETON: Then it does sound like you're going to have a very high correlation of 2.390 equaling CUI. It's either proprietary.

MS. MENSAH: Yes.

MR. STAPLETON: It's financial. It's personal, it's security. It's --

MS. MENSAH: Right.

MR. STAPLETON: You're going to have a tough time saying, no, it's not.

MS. MENSAH: Right. So we have to mark it as the staff, though. That's the only difference.

We can't require the licensee to mark using CUI compliant markings --

MR. STAPLETON: Right.

MS. MENSAH: -- because IT'S their information.

MR. STAPLETON: Right. No, I understand.

I guess this question is a little bit more for NARA.

Is it feasible that a licensee could submit to a government agency and say this is information that is provided to you as to 2.390 information, not to be NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

86 released, and may be marked as CUI by the government agency that it's being provided to? However, upon release of that information back to the originator, it reverts back to their marking scheme? Which I mean kind of sounds fair, honestly, but --

MR. LEE: Well, for now if the industry sends in information to the agency, the agency becomes the designated agency and they have to mark it as such as CUI. And when it leaves the agency to any entity, whether it be another agency or a non-governmental entity, it has to keep this CUI markings on it. Does that answer your question?

MR. STAPLETON: It does. I guess what I'm asking is, since we're making up new rules here, maybe we should consider that when it goes -- I mean we spend a lot of time with safeguards information, classified information, and we put a lot of emphasis on the originator of the information.

In a classified world, if we get something from the CIA, I'm not the one who decides to de-designate or declassify the information. I have to go back to the originator. So we put a lot of emphasis on the originator. And in this case, it just seems like we're taking that authority away from them.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

87 MR. LEE: So I mean there are -- it will be -- it'll most likely be based on the same laws, regulations, and government-wide policies so that the only difference with that would be that it would have different CUI markings on it.

The thing is that we didn't actually anticipate this, and that's why we're here to get industry's insight and dilemmas so that we can have more guidance. And the CFR actually has a lot of flexibility in giving out like some waivers. For example, if there's waivers that may apply here and we need to talk about it a little more. And as we develop more conversation -- as you get more conversations from other agencies and, you know, this not be -- just be limited to NRC, but the -- be everywhere or other agencies might have different questions and different agent.

So I actually definitely recommend that you sign up for the ISOO blog, and definitely take a look over at their CUI notices that will be forthcoming which will be clarifying, the 32 CFR 2002 and other authorities. And it might even supersede previous CUI notices based on the needs of the program.

And a lot of the questions asked here today, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

88 there have been CUI notices in the past as well. So I highly recommend that you read over those. And then as the CUI program becomes a lot more important, and it is ramping up quite faster than ever before, and there will be a lot of CUI notices coming.

And I highly recommend that you -- if there are any other questions, I know that some people don't like speaking up in rooms or whatnot, or speaking up on the phone, to e-mail CUI@NARA.gov. We try to answer any questions as possible, and we try to make -- excuse me -- we try to make time for like face to face meetings if there are very industry specific or agency specific questions.

So I definitely -- not all the rules are set in stone at this point. The CUI program is constantly changing. I mean there is some flexibility of changing. So, absolutely, let us know of your concerns in writing and we'll definitely take this back with our supervisors and discuss this as well in detail.

MR. STAPLETON: Thank you.

MS. JARRIEL: Lisamarie Jarriel. I'm with the NRC. I oversee our NRC allegation program and another SUNSI category that we have is allegation information, and in particular whistleblower identity NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

89 which is also a category in CUI.

And similar to I think what Bern was saying, we wouldn't expect the alleger, whose identify we're protecting, when we stamp it CUI and send a response to their allegation back to have to protect their own identity. If they want to say, hey, I'm the one that went to the NRC, they would have that right. They have that right today. So that would be another example of a waiver needed for their public handling of their own information that we're saying -- protecting. The originator.

MS. WALLACE: Just to add to that, that's similar to IRS information which is tax payer information. It's your information and once you send it back to that person, it's their information, they can do whatever they want with it. Just because we marked it and we handled it and protected it because of the law, regulation or wide policy, we did our job.

Once it's in their hands, you did your job by sending it back to them and it's going to be protected in their own way. So that's a really good thing. So I understand what you're saying.

MR. LEE: Also to add to that, I'm not actually quite sure but it might fall under the Privacy NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

90 Act as well. So that is to an individual, so that it might not be --

MS. WALLACE: Right.

MR. LEE: So it's -- correct, so, yeah, they do not -- individuals do not have to protect it as such.

MR. MUSSATTI: Okay. Please speak into the microphone --

MR. LEE: Oh, I apologize.

MR. MUSSATTI: -- because we're trying to get a record here.

MR. LEE: Yeah. To answer your question, that Charlene said in regards to federal tax information if they receive it back, it is a CUI category FTI, but once they get it back to that individual they can do whatever they please. They can, you know, show it to whomever they want. They don't have to protect it as CUI. And I think this will be in line with the Privacy Act and FOIA laws as well because those two federal disclosure laws trumps CUI program.

MR. MUSSATTI: Okay, Melinda, is there any on the phone that wants to make a comment?

OPERATOR: We are showing no comments or questions.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

91 MR. MUSSATTI: Okay, thank you.

MR. BARSTOW: Jim Barstow with Exelon.

So one of the things for future engagement, I think

-- I know you mentioned that you've gone through, you know, scenarios and looking at, you know, where CUI activity will take place, that kind of thing. I think sitting down with industry, you know, once we've had a chance to digest kind of what we learned today, you've had a chance to look at, you know, business practices, that kind of thing, and maybe sit down in a workshop format and go through the scenarios. And I think that would enlighten all of us and, you know --

MR. FLANDERS: And do a tabletop maybe.

MR. BARSTOW: Yeah.

MR. FLANDERS: Some safety evaluation reports, that type of thing.

MR. BARSTOW: Yeah.

MR. FLANDERS: That's a good suggestion.

MS. STAIGER: This is Maggie Staiger.

With regard to your management directive 12.6, will there be an option for licensees to be involved or have comments?

MS. MENSAH: This is Tanya Mensah. So there is no public comment period on the management NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

92 directive. I think part of what we're trying to do to just keep everybody engaged, though, is through these meetings and through these forms just to kind of make sure that industry is aware of the options that we're planning to implement, some of them are very specific to the NRC in terms of are we using cover sheets? If so, what types of CUI require them? How are we going to establish our controlled environment, you know, to meet the regulations? You know, destruction requirements. So some of them very specific to the NRC.

I don't know if Scott wants to add anything to that, but generally we're trying to use these engagements to make sure that you're aware of what we're planning to implement before the management directive is published.

MR. FLANDERS: Yeah, I think you've covered it well, Tanya. I would just say that really not only to make you aware, but also to have input to understand from your perspective the potential impacts so we can take that into consideration in terms of the aspects of the rule that effect external stakeholders, and that you have a strong understanding of that.

But as Tanya said, the management directive NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

93 has significant amount of additional things that directly point to how we need to handle it as a federal agency that may go beyond maybe what your interests may be. But certainly once it's finished, it's available publically.

MS. STAIGER: Thank you. This is also Maggie Staiger. With regard to the CUI training you're developing for NRC, would there be an opportunity for the industry to interact with some of the training in regard to the interactions between the NRC and CUI program?

MS. MENSAH: I think we can talk about that internally. We are just starting the process of thinking about how the training will look for staff, what needs to be included, making sure it aligns with the NARA CUI training requirements. They have like a training -- kind of like an outline for what agencies should expect to include. So I think we can take that comment under consideration, but --

MR. FLANDERS: Yeah, and I think -- maybe MS. WALLACE: Oh, I just wanted to add --

MR. FLANDERS: I can guess what Charlene's going to say.

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

94 MS. WALLACE: -- something for everybody in the room. We now have a training and awareness forum that we've started. I'm not sure if you guys were there for the first one, but it was very informative and it involves industry. So if you guys want to participate in that, that could help broaden everyone's information and education.

MR. FLANDERS: Yeah.

MS. WALLACE: So --

MR. FLANDERS: That's what I was going to say.

MR. MUSSATTI: Is there anybody else in the room that wants to speak? On the phones?

OPERATOR: Showing no phone questions.

MR. MUSSATTI: No? No? In fact, I kind of pride myself on trying to finish early. Well, it looks like we've come to the end of our -- not our time, but at the end of our discussion here for the day.

On behalf of the NRC staff, I'd like to comment on how smoothly this meeting went. You had a lot of decorum in our forum, and that makes things go well. It's been a pleasure serving you, and I hope the feeling is mutual.

On your way out, I think there are some NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

95 feedback forms and we would really appreciate some feedback as to how we can make the next meeting even better than this one. I don't see how because this was a really good meeting. But you can take that form, fill it out here and then leave, or take it with you.

It folds up if you do it right and there's a mailing label on the outside that's pre-post marked on it and everything so you don't have to worry about even spending the 50 cents on it. And just pop it in the mail. Or you can go online and scan one and PDF it back to Tanya or to the webpage there. And right now I'd like to invite Scott to close this meeting out formally.

MR. FLANDERS: Thanks Dan. First, let me start by saying I thought this was a very good dialogue.

I really appreciate your participation. Also the participation on the part of NARA, ISOO. That was really valuable. We look forward to further interactions with you, and also with industry and other external stakeholders.

I think Tanya identified some meetings that we want to -- or some topics we want to continue to have further dialogue on. As she said, you know, we don't have a set schedule, but we do want to, as we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

96 make progress kind of find some time to talk about these issues. And then also as we're working on particular topics, we'll be continuing to seek input from -- so I just want to thank everyone's participation. You gave us some good comments, some good things to think about as we continue to move forward with the implementation of the program. John, or Tanya, if you had any thoughts.

MR. MOSES: Yes, I just want to also extend my thanks to everyone here, a lot of creative ideas.

Thank you. We learned some things and some new ideas for us to consider. So we certainly appreciate your time and engagement, and look forward to engaging you again in the future.

MS. MENSAH: And this is just Tanya, just a reminder there will be a meeting summary and I will be the recipient of the transcript. So once that's available in ADAMs is public, I'll make everybody aware of that, and also it'll be referenced in the meeting summary.

And also, one of the things I wanted to just remind everybody here of is that after this meeting, if you have thoughts that come to you and you are like, oh, that would have been really great to share NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433

97 that with the NRC, I mean Maggie is my contact, and so she e-mails me, and so if there's anything that you want to offer in addition to what was discussed today, that's fine. You can reach out to John, to me through the contact information as well. So feel free to do that at any time.

MR. MUSSATTI: Okay. Well, the NRC is a safety oriented organization, so please be safe on your way home.

(Whereupon, the above-entitled matter went off the record at 3:28 pm.)

NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.

(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433