Regulatory Guide 5.12
| ML003740035 | |
| Person / Time | |
|---|---|
| Issue date: | 11/30/1973 |
| From: | Office of Nuclear Regulatory Research |
| To: | |
| References | |
| RG-5.12 | |
| Download: ML003740035 (5) | |
A. INTRODUCTION
Paragraph
50.34c) of 10 CFR Part 50, "Licensing of* Production and Utilization Facilities," requires each application for a liccn 'se to operate a production or utilization facility and paragraph
70.22(b).of*
10 CIFR Part '70. "Special Nuclear Material," requires.
certain applications for a license to possess or use special nuclear material (SNM) to include a physical security plan to demonstrate how thc applicant plans to meet' the physical protection requirements of 10 CFR Part 73, "~Physical Protection of Plants and Materials." Paragraphs
50.54(p) and 70.32(e) require existing licensees licensed under Part 50 and certain licensees licensed under Part 70 who have noit submitted a physical security plan to submit such a plan to the C~ommnission for approval.
Section 73.40 of 10CFR Part 73 requires that certain licensees provide. physical protectioni against industrial sabotage and against theft of SNM at the fixed sites where licensed activities
'are conducted.
Locks are acceptable devices to be used in adhering to the physical protection requirements identified above to assist in controlling access to areas, facilities, and nmaterials through doors, gates, container lids, and similar material or personnel access points, and are Iconsidered essential components Of a physical barrier. This guide provides criteria acceptable to the Regulatory Staff for the selection and use of commercially available locks in the protection of facilities and SNM.
B. DISCUSSION
Loicks are very important components of a physical barrier. Their effectiveness, however, lies in their use in conjunction with other security measures su6h as intrusion alarm systems and seals. Although some locks November 1973 IDE are diffieult to pick or manipulate, no lock can claim to Gmearnaiipuation proof." Because of the large variety of' Iocks' ivailable, it is necessary to subdivide the discussion
"`on locks into the following types:.(1)
combinat~ion, (2) kcy, (3) electrical, and (4) pushbutton mechanical locks. The discussion of each type includes a general section on advantages and disadvantages, a section on control over the locks, and a section on the applicable standards and specifications.
I.: Combinatlon Locks a. General. It ~is desirable that a combination ,lock be designed to afford a choice of a large number of combinations.
The number of combinations is 'Ic t.ý miincd by the'number of tumbler wheels in the lock mechanism and the number of graduations on the dial. High-quality locks 'usually have 100 divisions on the dial and -three tumbler wheels; such a lock is capable of providing a theoretical
10'- combina13tions, which in practice .reduces to -tens of thousands.
Sonic 'Combination locks are made with four tumbler wheels, but it is considered that the added number of combinations.
possible does not proportionally impro%0 the security of the lock and does increase the inconvenience~of,dialing the combination.
It is. desirable for a combination lock to be designed'so its, combinatlion can be easily changed but at the same time be tamper resistant.
The combination of ,some locks can be changed by disassembly of' the tumbler wheel, pack and relocation of screws or pins. In ,this method the effective number or combinations possible is res'trled.
Another method involves taking apart, the wheet pack and resetting an insert in each whiel.'Irhis method requires, substantial skill on the part of he operaf r. The most desirable method of changing a combination is ty a special key which requires minimal training o( the' operator and provides a mn'aximumn number of combinations.
The special key is inserted in USAEC REGULATORY
GUIDES Copies of publstid iuidt may be ebtseumd by t~etmmsu he dwo.sons ~efsmsd Ill IMw US. Ato= WcEoe -onlsn Wahngton.
D.C. 20545. Ruaouloory Guides we Issued to deoscrace and make ovallgtle go I.,. pubic Attention:
Ol,.ctor 9RmltrySedre C uset and suggestions for. smathods, acceptabie to the. AIEC Repulatory staff of implemesstinq Wecit 11a"no .4 spi osen waninthanI
mmuade we encouraged amid shoulid be sen to the Sectotars, tim Comm111460's rem~lultlom.
to 404ae~1 techniques musd by 1w staff on of also Cotonissien, US. Atomic 6u.vCommission, Wedthngton.
D.C. 20615, esmlueting specific problems or postulated accidmnts.
or to provide guiqens. to Attention -Chilef.PublicProceedingsStff.
applicants.
Regulatory Guides wea not substi wita hr mqgulshlons N end No iipnm omth them, is not reclired.
Mothoda end soltitons different fom thI wI Saot on The5 guede am issued Im the following tan broad divisions:
sheil umds will be acceptable if tlmey lpow. a basis #or few findingi reQuisrte to 11wmiued m onmnen oa erit or lmcene by the Commintsion.
I Power Rosctort 0. Products z. Remairds and Test Reactors
7. Transportaitoin
3. Fuels and Matalriela Pacilitres U. Occupat~onal Health Publasied gutdot vall be reme~nd pooodscsmly.
es aopropo~ts.
to accommnodate
4. Environmental end Sitime 9. Antitrust Revew" commn"nt and somaelect no5w mnfornmotmn or esperlence.
5. Materials end Plant Protection SO. General U.S. ATOMIC ENERGY COMMISSION
r~REGULATORY, GU / DIRECTORATE
OF REGULATORY
STANDARDS
REGULATORY
GUIDE 5.12 GENERAL USE OF LOCKS IN THE PROTECTION
AND CONTROL OF FACILITIES
the hack of lhe lock case ito ,clea- the wheels from: their presenlt combinalion while a new combination Is imposed by dialing.
The 'nhiaigi ii1 hocIti cans he 'oves Ily de:rllhiilu l hy usig a tadiographic technique.
it' I his is o lallack is designcd into certain locks by wi ilhilg nuilcials in Use munechanism that are 11111 easily aadiogr: pMIed. V.g.. plastcS. (Co ihil a lioli locks are vulnerable to cemanpromise if the hack of the lock is readily available, e.g.. when the lockable access is open. Removing the brck cover from the lock usually allows the combination to be determined.
The combinations of some key-change locks can be changed directly when the lock is in the open- position, while other must have the existing combination redialed to a different index when the access is in the open position to permit the combination change. The former type permits an intruder to make a quick change of the combination to one of his own choosing;
this would permit him to enter following the closing of the lock and would deny entry to the user. For these reasons it is desirable to protect the back of the lock by back plates or other devices.
High-quality combiination locks are designed for use in two basic forms: (I) in a lock case to be mounted on or into a door as a mortise or rim lock and (2) as a padlock.
Protection against forcible attack of a mortise elr rin-mounted lock can be increased if the lock is provided with hardened steel plates and If the lock is designed with relocking triggers or devices that deadlock the bolt or bolt-actuating mechanism.
Combination padlocks are not vulnerable to the usual rapping techniques and are usually resistant to manipulation.
However, common combination padlocks made of a aluminum alloy are without great strength, have little resistance to forcible attack, and are not weather resistant.
There are others that are weather resistant but offer little protection against attack. b. Combimtion Lock Control. The mint important aspect of lock control for comnbinatlon locks is the protection of the combination.
It Is desirable to changb the combination of a lock every time that a person who knows the combination no longer requires it as a result of termination or reassignment of duties. This would assure that only those Individuals actually required to gain access would know the combination.
Losing the combination of a manipulation.
proof, wdl-dsigned lock in a high-rated door is an expemive dtlation.
This can be prevented by keeping a record of the combination in another location which is as secure as the place protected by the lock.Combin;tlion locks can be set t) a single number to simplify the daily chore ofopeni.g, but this is.a very poor practice since it reduces the se'urity ol the lock. Frequently four-wheel locks are set to only three different numbers for ease tf opening. This deifcats thw purpose of the Iourth wheel but it is not considercd serious since the number of remaining combination choices is considered adequate.
It is not reconinicnded thal one select combinations in common sequences and multiples of ten. It is also not generally recommended that the last number of a combination be set close to zero because in some cases the lock can jam. c. Standards and Specificatiomn.
A standard for three. or four-tumbler combination locks issued by Underwriters'
Laboratories, U,-768, "Combination Locks,"' covers "combination locks designed for attachment on doors of safes, cheits, vaults, and' the like to provide a means of locking the boltwork against unauthorized opening." Quality assurance provisions covering the description, examination, and testing of the product am included through the UL Label Service. A Federal Specification issued for combination padlocks.
FF-P-IIOF, 'Padlock, Changeable Combination (Resistant to Opening by Manipulation and Surreptitious Attack),'
'Includes quality assurance provisions for design, materials, and performance testing.
2. Key Locks a. GeneraL As in the case of combination locks It is desirable for a key lock to be capable of being set for a larp, number of different kiys. A high-quality six-pin lock with 10 key cutting levels per pin potentially permits 106 different keys to be used. However, this large number of key cuts is not as useful as a larIp number of combinations because less time.consuming techniques for defeating key locks .are available.
Nevertheless, there Is value In specifying at least 10 key cuts because it requires careful construction of the lock. It is important that the key 'c60 required to open a lock (bitting of a lock) be changeable to permit changes whenever keys are lost or an employee having access to a key is reassigned to other duties or 'Copvie nay be obtained from the offie and testing stations of Underwriters'
Laboratories, Inc located at the following addreses:
207 East Okle Street, Odcag, ill. 60611; 333 Plnpften Road, North1kok., 1IL 60062; 1285 Waft Whitman Road, Melille, I, N.Y. 11746; 1655 Scott BouevUrd, Santa Clara. Calif. 95050. IC6pies may be- obtained from busizess service centers of the General Services Adnin, Reglonal Omca located in tih follwtg ili: = iq, M lieNew York, N.Y.; Washin0om, D.C.; Ft. WWOmTex birce. Cob.; S&Ps :ranchc, Calif.; Atlanta, Ca. G"C IVI; Kaxua City, Me Los Arspim Calif.; Settile. Wash.5.I12.2 terminated.
('hanging the hitting of a lock in' be accomplished usually by changing pins, wafers, or lcvers. To case the task of a bitting change, some locks have cores that are removable for replacement by means of a special key called a "control key." If all the locks in a given facility are keyed to the same.control key, the locks are virtually master keyed because, with the core removed, the problem of opening the lock is elementary.
Master keying is undesirable from a security point of view because disassembly and inspection of any lock In the system by a competent person provides access to all the other locks in the master-keyed system, and because termination of an employee who had access to a master key would require changing the bitting of all locks set for his master key. The changing of the bitting of a large number of locks can be costly, but the convenience of master systems is such that there is strong pressure for using them. A compromise in this conflict between convenience and security may be to use a nonmastered set of locks for protected areas, material access areas, vital areas, and access to vital equipment and to permit master key sets for other less sensitive areas. It is necessary for a lock to have some resistance to picking and impressioning (a method used to prepare a key by the impressions of the bitting of a lock on a blank key). In general, this resistance can be provided by precision machining of the mechanisms or by special design features such as side bars, odd-shaped pins or a large number of levers. Protection of key locks against forcible attack can be enhanced by the use of hardened steel plates in front of the pins or side bars. It is essential for a bolt of a lock to be retained in the locked position by positive means (dead bolt). In some locks, the bolt is held in a locked position by a spring only. This permits. in the case of padlocks, the use of appropriate rapping or shimming techniques and, in the case of door locks, the opportunity to surreptitiously retract the bolt without the use of force. b. Lock Control. The security of an access control system based on key locks depends on complete denial of keys to unauthorized persons. It is essential to have a record of each key and the names of individuals to whom keys have been issued and to check all keys at periodic intervals.
A common weakness in mastered key systems is the lack ot accountability of lock cylinders.
To correct this situation, it would be necessary to require a control system involving the accountability of every mastered lock cylinder having the bitting in present use either for the master or, in the case of removable cores, the control key.c. Standards and Specifications.
A standard t'oi key locks has been issued by Underwriters'
Laboratories.
UL-437, "Key Locks."' and lnclud quality assurance provisions through the UL. Label Service. Interim Federal Specification FF-P-001480 (GSA-FSS), "Padlock, Key Operated (Resistant to Opening by Force, Pick, and Bypass Techniques)," 2 covers two types of key-operated dead-bolt padlocks:
the exposed shackle and the ..shrouded shackle. (4ility assurance provisions concerning the design, materials, and qualification testing are included.
3. Electric Locks a. General. In the most popular electric locks, a signal generated by magnetized elements in a plastic card or by sequential activation of buttons is compared with a stored code to activate an electrically operated door strike, in some cases the magnetic card, and pushbutton systems are used in coincidence.
Combined card and pushbotton systems provide, in general, higher security than card-only systems.
The advantages of the electric lock are isolation of the part containing the code from the r "posed part of the lock, versatility of programming, afid ease of integration into alarm systems.
Magnetic card systems have some of the problems of common key locks because a lost or stolen card can be used by an unauthorized person. Howeve%, reproduction of a card is more complicated than reproduction of a metal key. Pushbutton systems require memorization of a few digits, usually four, and require more time to operate than the magnetic card system. Although the number of possible combinations usually is smaller than in the combination lock system, quality electric pushbutton systems compensate for this by incorporating devices which prevent trial and error methods of surreptitious attack by activating an alarm after a number of unsuccessful attempts or by introducing a delay after each unsuccessful attempt which prevents operation of the lock for a short period of lime. It is desirable for an electric lock to have the capability for an easy change of combinations.
The part of the lock where the combination is set and the housing of the card reader (if the contents of the housing can reveal the combination)
should be protected against tampering by tamper switches connected to the alarm system. Generally, where electric locks are installed, a mechanical lock is also installed as a bypass. This lock should be of a quality as discussed in the part on key locks in this guide.5.12-3 b. Lock Control. The security ofan clectric lock system depends on strict control or combinations and cards. The magnetic codes in the cards and the combinations need to be changed whenever an employee having had access to them terminates or is reassigned.
Strict accountability of cards Is strongly recommended.
c. Standards and Specifications.
There are currently no comprehensive standards or specifications covering electric locks. The reputation of the manufacturer, the specification
'for his product. and the experience of users must be carefully considered in their selection and use. 4. Pushbutton Mechanical Locks a. General. This is a type of combination lock utilizing mechardcal-pushbutton-activated linkages that connect a gate with an external knob topermit opening of the lock. In this lock it is difficult to design in penalties for punching a wrong combination as is done in electric locks. Therefore, it is important to have a large number of possible combinations.
Provisions for easy change of combinations are desirable.
Some locks permit a new combination to be dialed in utilizing an Allen wrench when the lock is open, a procedure similar to that for some combination locks. Others require the replacement of Internal parts to change the combination.
The mechanical locks appear to be fairly resistant to concealed attack: however, more information is needed on their resistance to forcible attack. b. Lock Control. Similar to other combination locks, the combinations need to be changed when employees having access to the combination terminate or arereassigned.
c. Quality Assurance.
There are currently no comprehensive standards or specifications for mechanical pushbutton locks. C. REGULATORY
POSITION The following guidelines are acceptable to the Regulatory staff for the selection and use of locks in the protection of facilities and SNM: I. Combination locks installed in solid doors such as those in vaults or vault-type rooms in protected areas should he three. or four-position dial.type changeable.
combination locks meeting the Underwriters'
Laboratories Standard UL-768. "Combination Locks," for Group I locks.' 2. Combination padlocks should be used when practicable on doors or gates to material access areas, in protected and vital area perimeters, and for access to vital equipment in preference to key padlocks.
Combination padlocks should be used on dosed vehicles or containers holding SNM that are required to be locked. Combination padlocks should be three-position.
dial type changeable-combination padlocks meeting Federal Specification FF-P-I I OF, "Padlock, Changeable
('ombination (Resistant to Opening by Manipulation and Surreptitious Attack)." 2 3. Key locks used in lieu of combination padlocks on doors or gates to material access areas, in protected and vital area perimeters, and for access to vital equipment should provide a high degree of resistance to opening by force and tamper techniques and should meet Underwrite'
Laboratories UL-437, "Key Locks."' 4., Key padlocks used in lieu of combination padlocks on doch or, ptes to material access areas, In protected and vital area perimeters, and for access to vital equipment should be of nugged and sturdy construction and designed for outdoor use if necessary, and should meet Interim Federal Specification FF-P-001480 (GSA FSS), "Padlock, Key Operated (Resistant to Opening by Force, Pick, and Bypass Techniques)."'2 S. -ýtric locks should be used inside the protected area a, a means of access control only If a magnetic card key syysezn is coupled with a pushbutton system and !' i,.d into the alarm system. This lock combination should have features that resist tampering with the combination-changing mechanism and that alarm after a set number of errors in punching the combinations is made. 6. Pushbatton mechanical locks are not recommended for use at this time because of the lack of comprehensive standards and specifications against which the locks can be evaluated.
7. Mechanical locks used as panic locks on emergency exit. doors within protected area perimeters should be operable only from the inside. 8.. Combinations, keys and locks should be controlled, protected and changed in accordance with the following requirements:
a. Combinations of locks or padlocks on repositories containing SNM or used to secure gates or doors to material access areas, in protected and vital area perimeters, and for access to vital equipment should be known only to those authorized access to the material or to the area. They should be changed when repositories or areas are first placed in use, whenever a person knowing the combination no longer requires it as a result of reassignment of duties or termination, whenever the combination may have been compromised, or at least twice every year. A record of the combinations of locks should be kept in a location that is secured by a combination lock.
b. Keys and cards to locks or padlocks on containers holding SNM or used to secure ptes or doors to material access areas and in protected and vital area perimeters should be issued only to persons authorized acss to the material or to the area. Keys or cards in use should be dcecked in at the end of each shift or workday, and a log should be maintained showing keys and cards, users, in and out times, and other pertinent inflrmation.
Keys and cards should be recovered from reassigned or terminating personnel.
Locks should be immediately changed or cores replaced and an inventory conducted whenever a core, key, or card is lost or r.ussing;
the lock, care, key, or card has been compromised.
or unrecorded keys or cards are found. In a mastered system, a complete remastering of the system should be conducted whenever a core, card, master or control key, or a lock is lost or compromised.
c. A record of all locks, cores, keys, and cards should be maintained and kept in a location secured by a combination lock. A physical inventory of locks, cores. keys, and cards should be conducted semiannually when the locks are used for protection of facilities and bimonthly when the locks are used for the protection of SNM. Unused locks, cores, keys, and cards should be stored in a location secured by a combination lock. A specific individual at each site should be named aid placed In charge of all locks, cores, keys, and cards.5 12-5