Regulatory Guide 5.61

Intent and Scope of the Physical Protection Upgrade Rule Requirements for Fixed Sites

ML003739270
Person / Time
Issue date:	06/30/1980
From:	Office of Nuclear Regulatory Research
To:
References
RG-5.61
Download: ML003739270 (20)

UNITED STATES

.,A NUCLEAR REGULATORY COMMISSION

r *WASHINGTON, D. C. 20555 July 7, 1980

Regulatory Guide 5.61

.REGULATORY GUIDE DISTRIBUTION LIST (DIVISION 5)

SUBJECT: Regulatory Guide 5.61, "Intent and Scope of the Physical Protection Upgrade Rule Requirements for Fixed Sites"

Regulatory Guide 5.61 is being issued as an active guide. The information that provided the basis for the preparation of the guide was distributed for comment as a draft report to all affected licensees and to other interested parties who attended the NRC Upgrade Rule Guide Seminar held on March 27-28, 1979, in Richmond, Virginia. No comments were received as a result of this distribution. The resulting active guide is being issued so that affected licensees may use it for preparation of their physical protection plans in response to the new requirements of 10 CFR Part 73 published in the Federal Register on November 28, 1979 (44 FR' 68184).

Since a draft guide was not distributed for comment, copies of this active guide are being sent to all addressees on the Division 5 distribution list.

Although comments are always encouraged on all regulatory guides, comments on this guide are particularly encouraged at this time since a draft guide for comment was not published.

Robert B. Minogue, Dir tor Office of Standards Development

.II

June 1980

U.S. NUCLEAR REGULATORY COMMISSION

bREGULATORY

OFFICE OF STANDARDS DEVELOPMENT

GUIDE

REGULATORY GUIDE 5.61 INTENT AND SCOPE OF THE PHYSICAL PROTECTION UPGRADE RULE

REQUIREMENTS FOR FIXED SITES

A. INTRODUCTION

For radiological sabotage, two basic adversary types are defined. The first is an external assault by several persons in On November 28, 1979, strengthened physical protection which the attackers are assumed to be well armed, well trained, requirements for fuel cycle facilities and transportation and able to obtain inside help. The second postulated adver involving formula quantities of strategic special nuclear sary is a single insider who may be employed in any posi material were published in the FederalRegister (44 FR 68184). tion and who may have an NRC or DOE security clearance.

The "Physical Protection Upgrade Rule" is the short title for these requirements. This guide provides information to For theft or diversion, the basic external assault threat is assist in understanding the physical security requirements similar to that for radiological sabotage, except that the for, fuel cycle facilities set forth in §§ 73.1, 73.20, 73.45, adversaries are assumed to be capable of operating as two or and 73.46 of the Physical Protection Upgrade Rule. Section more teams. The internal theft or diversion threat is mark B, "Discussion," provides an overview of the major sections edly different from that for radiological sabotage in that it of the rule and discusses (1) how the Physical Protection also includes a conspiracy among individuals either with Upgrade Rule is structured, (2) what the purposes of its access to and knowledge of facilities and activities or major provisions are, and (3) what interrelationships exist equipped with items that could facilitate theft of material among the three major portions of the rule that contain subject to this rule.

requirements for the physical protection of fixed sites.

Section C, Regulatory Position, attempts, by means of a question and answer format, to explain, why certain fixed 2. General Performance Objective and Requirements: Para site requirements are included in the rule and to clarify the graphs 73.20(a) and (b)

intent of these requirements.

The general performance objective and requirements are

B. DISCUSSION

referenced to the threat statements of § 73.1, wherein appropriate design basis threats for protecting against This section is intended to give the reader a broad radiological sabotage and preventing theft of special nuclear overview of the structure of the Physical Protection Upgrade material are specified.

Rule as it applies to fixed sites and the purpose of Its major provisions. A review of the threat statement is included. Paragraph 73.20(a) is the fuist of the two performance The Physical Protection Upgrade Rule is structured in three oriented levels and sets forth the rule's basic parameters.

distinct levels; two are essentially performance oriented and This paragraph states who is covered by these regulations;

the third, a reference physical protection system, is specifica i.e., licensees authorized to operate fuel reprocessing plants tion oriented. pursuant to 10 CFR Part 50, licensees who operate facilities that possess or use formula quantities of strategic special L. Purpose and Scope: § 73.1 (Threat Statement) nuclear materials, and licensees involved in the transport or delivery of formula quantities of strategic special nuclear Paragraphs 73.1(aX)) and (aX2) describe the types of material, including import and export. On an interim basis, threats against which the physical protection system must non-power reactors are not subject to the Physical Protection be effective. Distinctions are made between the overall Upgrade Rule requirements. It further states that those protection level to be provided against radiological sabo covered by these regulations must establish and maintain or tage and that required against theft or diversion of SSNM. make arrangements for a physical protection system which USNRC REGULATORY GUIDES Comments ihould be sent to the Secretary of the Commission, U.S. Nuclear Attention: Regulatory Docketing and Service Branch. Washington, D.C. 20555.

Commission the Regulatory Guides are Issued to describe and Make available to public methods acceptable to the NRC staff of implementing apecific parts of the Commlsslon's regulations, to delineatepostutech- The guides are Issued In the following ten broad divisions: "

nlques used by the staff In evaluating specific problems or lated accidents or to provide guidance to applicants. Regulatory 1. Power Reactors 6. Products Guides are noW substitutes for regulations, and compliance with 2. Research and Test Reactors .7. Transportation them Is not required. Methods and solutions different from those set 3. Fuels and Materials Facilities 6. Occupational Health out in the guides will be acceptable if they provide a basis for the 4. Environmental and Siting 9. Antitrust and Financial Review to the issuance or continuance of a permit or 5. Materials and Plant Protection 10. General license byrequisite findings the Commiession. Copies of Issued guides may be purchased at the current Government Comments and suggestions for improvements in these guides are Printing Office price. A subscription service for future guides In*pe encouraged at all times, and guides will be revised, as appropriate. cific divisions Is available through the Government Printing Office.

to accommodate comments and to reflect new information or Information on the subscription service and current GPO prices may experience. This guide was revised as a result of su.btantive corn- be obtained by writing the U.S. Nuclear Regulatory Commission, ments received from the public and additional Staff review. Washington, D.C. 20555, Attention: Publications Sales Manager.

I I

will have as its objective to provide high assurance that with authorized access to a material access area or a vital activities involving special nuclear material are not inimical area. This problem is addressed by the third layer of perform to the common defense and security and do not constitute ance capabilities delineated in paragraph 73.45(c) which an unreasonable risk to the public health and safety. requires that the physical protection system permit only authorized activities and conditions within protected areas, Paragraph 73.20(b) describes how licensees covered by material access areas, and vital areas, and paragraph 73.45(d)

these regulations are to provide effective physical protection which requires that the physical protection system permit systems meeting the general performance objective of only authorized placement and movement of strategic paragraph (a) of section 73.20. To meet the general perform special nuclear material within material access areas. These ance objective, a licensee must establish and maintain or two performance capabilities ensure that, even in cases in arrange for a physical protection system. That physical which the adversary is authorized access to material access protection system must include the characteristics defined areas or vital areas and is authorized to handle and move in paragraphs (b)(1) through (b)(3), which require that the SSNM, the physical protection system will be capable of physical protection system (1) provide the performance detecting the unauthorized adversary act and initiating an capabilities of section 73.45, (2) be designed with redundancy effective response. The fourth protection layer permits the and diversity, and (3) include a testing and maintenance removal of only authorized and confirmed forms and program as described therein. amounts of strategic special nuclear material from material access areas (paragraph 73.45(e)).

3. Performance Capabilities for Fixed Site Physical Protec tion: § 73.45 The final performance capability [paragraph 73.45(g)]

is that the physical protection system must provide a Paragraph 73.20(bX 1) provides a direct link between the response capability to assure that the five capabilities general performance requirements and the performance described in paragraphs (b) through (f) of § 73.45 are capabilities that comprise the second of the performance achieved. In cases where the adversary initiates action oriented levels. This paragraph states that, in order to meet outside the facility or in the facility's protected areas, he the general performance requirements of paragraph 73.20(a), will face redundant protection in the several layers of a licensee must establish and maintain or arrange for a performance capabilities remaining between him and his physical protection system that provides the performance objective. But, again, the primary purpose for this layering capabilities described in § 73.45 for fixed site protection of performance capabilities is to ensure that an unauthorized unless otherwise authorized by the Commission. Thus, a act by an adversary will be detected as soon as it is initiated, physical protection system must be designed to satisfy the regardless of who the adversary is or where within the performance capabilities in order to meet the objective of providing high assurance of preventing the theft of SSNM

facility he is located.

K.

and protecting against radiological sabotage by the previously The proper implementation of these performance described adversaries. capabilities will provide the desired high assurance that the physical protection system can prevent the theft of strategic Because the adversary may consist of insiders operating special nuclear material and protect against radiological alone or in combination with persons without authorized sabotage by any of the postulated adversaries at any given access, the adversary is able to initiate his activities inside as time.

well as outside the facility. In order to provide the required level of assurance, the physical protection system must 4. Fixed Site Physical Protection Systems, Subsystems, be able to detect, assess, and respond to unauthorized acts Components, and Procedures: § 73.46 (Reference initiated at any point outside or inside the facility. The System)

performance capabilities necessary to provide assurance that the act will be prevented may, therefore, be viewed Regulatory guidance to assist in ensuring the proper as a series of four protection layers that detect and respond implementation of the performance capabilities identified to an unauthorized act initiated at any point. in § 73.45 in the design of a physical protection system are contained in § 73.46 and constitute the third major level of Starting from the facility perimeter and working inward, the Physical Protection Upgrade Rule. Section 73.46 delineates the first protection layer consists of the performance those safeguards measures that usually will be included in a capability delineated in paragraph 73.45(f), which is to physical protection system that satisfies the performance provide for authorized access and assure detection of and capability requirements. In order to clarify the relationship response to unauthorized penetrations of the protected between the reference system in § 73.46 and the perform area. This performance capability is the first line of defense ance capabilities in § 73.45, Table I has been developed.

against external groups, but does not provide protection This table is organized by performance capability, with against persons or material with authorized access to the each capability function and subfunction designated in the facility. The second protection layer is the performance rule as necessary to achieve that performance capability capability delineated in paragraph 73.45(b), which is to listed as a separate column heading. Under each heading are prevent umauthorized access of persons and materials into listed all the provisions from the reference system (§ 73.46)

material access areas and vital areas. This performance that fulfill some portion of that function or.subfunction.

capability denies unauthorized access to a material access The table shows how the reference system may be used to area or a vital area but is still not effective against adversaries provide the functions or subfunctions necessary to each

5.61-2

performance capability and thus to achieve each performanc e dancy and diversity to assure maintenance of the capabilities capability itself. The table provides several types of informi t- described in § 73.45. In terms of information provided by tion on how safeguards measures can be used to help satisf y the table, this means that components providing redundancy a required function or subfunction. In providing thi[s and diversity will not be found in every column, but only in information, various situations must be considered. Fc or those in which the criteria of the reference system makes fixed sites, the reference system must consider situationi al their inclusion warranted. Thus, in providing the functions and timing differences (for example, working hours versuis and subfunctions of the performance capabilities as shown non-working hours). through the columns on the table, guidance is given showing the usual level for redundancy and diversity needed to The column headed by paragraph 73.45(bX2)(ii) provide3s satisfy paragraph 73.20(b)(2).

an example. This paragraph deals with entry controls an d procedures for the detection of attempts to gain unauthc - 6. Testing and Maintenance: Paragraph 73.20(bX3)

rized access into material access areas and vital areas b y deceit. The paragraphs from the reference system thait Paragraph 73.20(bX3) requires the physical protection comprise the body of the column contain components an d system to include a testing and maintenance program to measures for dealing with entry attempts by employee:S, assure control over all activities and devices affecting the non-employees requiring frequent access, visitors, individualIs effectiveness, reliability, and availability of the physical with NRC or DOE material access authorizations, vehicle:s, protection system, including a demonstration that any and materials. There are also safeguards measures listed fcor defects of such activities will be corrected for the total key, lock, and combination control and for communici a- period of time, they are required as a part of the physical tions. Thus, the reference system contains different ways cof protection system. This requirement is intended to ensure providing these subfunctions of the performance capabilit y that all procedures and hardware will remain effective, under different circumstances. Some of the activitie:s, reliable, and available at all times. This requires programs to equipment, and design features needed to provide 0h[e promptly detect any defects and to correct them in a functions and subfunctions are not time sensitive (that i s, timely manner. It also requires a program to provide they must be in effect or be operational at all times ). alternative measures to replace the capabilities lost while Physical barriers, for-example, are not the type of safeguard Is the maintenance and repair is being accomplished.

to be effective only at certain time S.

measure that needs Testing and maintenance that normally will be included To provide this same high assurance of protection ovr er in a system providing the capabilities required by paragraph time, paragraph 73.20(b) of the general performancCe 73.20(bX3) are described in paragraph 73.46(g) of the requirements, contains two additional requirement s, reference system. In order to ensure that required perform redundancy and diversity and testing and maintenanco e. ance capability functions or subfunctions are performed, the reference system provides guidance for a testing and

5. Redundancy and Diversity: Paragraph 73.20(bX2) maintenance program. The purpose of any testing and maintenance program should be to ensure continued Paragraph 73.20(b)(2) requires that the physical prote,C- operation of the safeguards measures that are used to tion system be designed with sufficient redundancy an d provide those functions or subfunctions.

diversity to assure maintenance of the capabilities describe d in section 73.45. To provide protection against the failuj re Table I delineates reference system maintenance provi of physical protection system measures that would cause a sions corresponding to the appropriate performance capa performance capability not to be satisfied, the system mu:st bilities of § 73.45.

be designed with redundancy and diversity. That is, redundayit and diverse means of providing functions or subfunctioi is

Q. REGULATORY POSITION

must be included to ensure that no single adversary act ( or no single safeguards-measure failure will cause the overaill This section provides the rationale for and clarifies the system to fail. Redundancy means providing more than or le intent of particular requirements for fixed sites in the measure (which may be the same measure duplicated) IVo Physical Protection Upgrade Rule.

perform a given function or subfunction. Diversity meai is providing two or more different kinds of measures that a1l § 73.1 Purpose and Scope (Threat Statement)

perform or contribute to the same function or subfunctic on but that have different operating characteristics (such as Q: Is there more concern for theft of SNM than for sensitivities, failure modes, strengths, and weaknesses ).

radiological sabotage?

Table I is useful in clarifying the role of redundancy anLd A: The threat statements reflect the position that there diversity in the physical protection system. Paragraph 73.46(g)( 5) is a greater risk to the public from theft of SNM at a fuel of the reference system implies that redundancy and dive r- cycle facility than from radiological sabotage because of the sity are not required everywhere, but only i those cases in type and form of SNM actually located at existing fuel which the effectiveness of the physical protection systeim cycle facilities. Therefore, it is necessary for licensees'

would be compromised by failure or other contingencie s. physical protection systems to provide a level of assurance As stated in paragraph 73.20(b), this means that the physic al that is consistent with the higher potential damage to the protection system must be designed with sufficient redu:n- national security and public health and safety.

5.61-3 I I

TABLE I

RELATIONSHIP BETWEEN THE FIXED SITE PERFORMANCE CAPABILITIES (§ 73.45)

AND THE FIXED SITE PHYSICAL PROTECTION REFERENCE 1EASURES (6 73.46)

73.45(b)

(b) Prevent unauthorized access of persons, vehicles, and materials Into material access areas and vital areas. To achieve this capability the physical protection system shall:

(1) Detect attempts to gain unauthorized access or Introduce unauthorized (2) Detect attempts to gain unauthorized access or Introduce unauthorized material across material access or vital area boundaries by stealth or force materials into material access areas or vital areas by deceit using the follow using the following subsystems and subfunctions: Ing subsystems and subfunctions:

(i) Barriers to channel persons and (Ii) Access detection subsystems and (I) Access authorization controls and (ii) Entry controls and procedures to material to material access and vital procedures to detect, assess and com procedures to provide current authori verify the Identity of persons and area entry control points and to delay municate any unauthorized penetration zation schedules and entry criteria materials and assess such Identity any unauthorized penetration attempts attempts by persons or materials at for both persons and materials; and against current authorization schedules by persons or materials sufficient to the time of the attempt so that a and entry criteria before permitting

0% assist detection and permit a response response can prevent the unauthorized entry and to initiate response measures that will prevent the penetration; and access or penetration. to deny unauthorized entries.

73.46 c 1 73.46(c)(41 g)(2 73.469d11 73.46(d)(1)

g I 9) g)3 (d)(2)

g 2 d)(3)

g 3 d) (9)

g 4 eS h 4(i) d)(14)

e7 h 4()

f 111 h 4 i g 16)

f

1f1118 h5 f 2 h 6 f 3

( N C I-ý

K

TABLE 1 (COTITUED)

73.45(c)

(c) Permit only authorized activities and conditions within protected areas, material access areas, and vital areas. To achieve this capability the Physical protection system shall:

(1) Detect unauthorized activities or conditions within protected areas, material access areas and vital areas using the following subsystems

"and subfunctions:

(i) Controls end procedures that establish (ii) Boundaries to define areas within (111)Detection and surveillance subsystems current schedules of authorized activities which the authorized activities and condi and procedures to discover and assess unauth and conditions in defined areas; tions are permitted; and orized activities and conditions and coumln cate them so that response can be such as to

!_J1 stop the activity or correct the conditions before strategic special nuclear material is stolen or radiological sabotage committed.

73.461dli] 73.46(c)1) 73.461 c)2) 43)

8)

10)

11

12i i)

Ii)

lii)

TABLE 1 (CONTINUED)

73.45Ud)

(d) Peruit only authorized placement and movement of strategic special nuclear material within material access areas.

To achieve this capability the physical protection system shall:

(1) Detect unauthorized placement and movement of.strategic special nuclear material within the material access area using the following subsystems and subfunctions:

(i) Controls and procedures to delineate (i11) Controls and procedures to (III) Controls and procedures to main (iv) Detection and monitoring sub authorized placement and control for establish current authorized place tain knowledge of the identity, quantity. system and procedures to discover strategic special nuclear materiel; ment and movement of all strategic placement, and movement of all strategic and assess unauthorized placement special nuclear material within special nuclear material within material and movement of strategic special material access areas; access areas; and nuclear materiel and comunicate them so that response can be such as to return the strategic special nuclear material to authorized placement or control.

73.461C 73/461c 73.46(c)(5) (g)(1)

73.46(cll) 1 1 51 c61(g 2)

d II1 (g)6)

h 4

1f2hll 47 11)

)

(f(31 h4 11,,)

(h)57)

r C

K'

TABLE 1 (caiTIRMiD)

73.45(e)

(e) Permit removal of only authorized and confirmed forms and amounts of strategic special nuclear material from material access areas. To achieve this capability the physical protection system shall:

(1) Detect attempts at unauthorized[ removal of strategic (2) Confirm the identity and quantity of strategic special nuclear material presented for special nuclear material from material access areas by steel th or removal from a material access area and detect attempts at unauthorized removal of strategic special force using the following subsystems and subfunctions: nuclear material from material access areas by deceit using the following subsystems and subfunctions:

Mi Barriers to channel persons (ii) Detection subsystems and MI Authorization controls and (Ii) Removal controls and pro- (1ii) Co~mmunications subsystems and materials exiting a material procedures to detect, assess procedures to provide current cedures to identify and confirm and procedures to provide for access area to exit control points and communicate any attempts schedules for authorized removal the properties and quantities notification of an attempted and to delay any unauthorized at unauthorized removal of of strategic special nuclear of material being removed and unauthorized or unconfirmed strategic special nuclear material strategic special nuclear ma material which specify the autho- verify the identity of the per- remval so that response can removal attempts sufficient to terial so that response to rized properties and quantities sons making the removal and be such as to prevent the

-J assist detectiom and assessment the attempt can be such as of material to be removed, the assess these against the current remoVal.

and permit a response that will to prevent the removal. persons authorized to r.nve the authorized removal schedule be prevent the removal - and material, and authorized time fore permitting removal; and schedule;

19 73.46(g)(6) 73.46 d 73.46 e(5) (g (5

73.46(c)(1) 73.46 1

10) e7 h4(ji)

12)

13 g 6) f11 Ih j '

16

'7

1

ý2

'31

TABLE I (CONTINUED)

73.45(f)

(f) Provide for authorized access and assure detection of and response to unauthorized penetrations of the protected area to prevent theft of strategic special nuclear material and to protect against radiological sabotage. To achieve this capability the physical protection system shall:

(1) Detect attempts to gain unauthorized access or introduce (2) Detect attempts to gain unauthorized access or introduce unauthorized persons, vehicles, or materials Into the protected unauthorized persons, vehicles. and materials into the proteAted area by stealth or force using the following subsystem and area by deceit using the following subsystems and subfunctions:

subfunctions:

(I) Barriers to channel persons, vehicles, (ii) Access detection subsystems and pro (i) Access authorization controls and pro (1i) Entry controls and procedures to and materials to protected area entry con cedures to detect, assess and comunicate ceduros to provide current authorization verify the identity of persons, materials, trol points; and to delay any unauthorized any unauthorized access or penetrations schedules and entry criteria for persons. and vehicles and assess such identity penetration attempts or the introduction or such attempts by persons, vehicles, or vehicles, and materials; and against current authorization schedules of unauthorized vehicles or materials suf materials at the time of the act or the before permitting entry and to initiate U, ficient to assist detection end assessment attempt so that the response can be such response measures to deny unauthorized and permit a response that will prevent as to prevent the unauthorized access or access.

the penetration or prevent such penetra penetration, or prevent such penetration tion from resulting In theft of strategic from resulting in theft of strategic special nuclear material or radiological special nuclear material or radiological sabotage; and sabotage.

73.461c I 73.46

73 46 Ic 2 . 111u1 73.46 e. 6 b uu'

I. 7 f

f~l2 Ih I1 d 6)

Ih 2 Ih 3 fhi61 I)

f

~ 311

( C £

TABLE I (CONTInED)

73.45()

(g) Response. Each physical protection program shall provide a response capability to assure that the five capabilities described In paragraphs (b) through (f) of this section are achieved end that adversary force will be engaged and Impeded until offslta assistance forces arrive. To achieve this capability a licenseeashall:

(1) Establish a security organization to: (2) Establish a predetermined (3) Provide equipmet for the security organization and facility design plan to respond to safeguards features to:

contingecy events.

(1) Provide trained and (00) Provide for routine .(I) Provide for rapid (00) Provide for response by (Mii) Provide protection qualified personnel to security operations and assessment of safeguards assigned security organization for the assessment and carry out assigned duties planned and predetermined continogences; personel which is sufficient- response personnel so that and responsibilities; and response to emergencies and ly rapid and effective to they can complete their safeguards contingencies. achieve the predetermined assigned duties.

objective of the response; and

73.461b 1l 73.461bl 1 73.461bi3i 73.46 a 1 73.46 b 1 73.46 b 1 b4b296a Z b4 b4 h 33he3 1 g I

ha 6e4 g2 g 2 h3a 3g 3

6 g4 g 4 a 7 g5 g 5 g 6 6 e9 h 3 I~

gC4

2 il)lIl~ h 5 g5 h 7 g6 h 6

(4) Provide coemuications netorks to: (S) Assure that a single adversary action cannot destroy the capability of the security organization to notify offsite response forces of the need for assistance.

1i) Transmit rapid aend accurate security (11) Transmit rapid and accurate formetion amon onsite forces for routine detection and assessment Infor security operation, assessment of a contin- mtion to offsIte forces.

gency, and response to a contingency; and

73.46 f 1 73.46 f 2 73.46 b 5~

f 2 f3 a 41 fh3 9l 1 S5 q 1g92 g 11

9 2 g 3 4g 21 g 3 g 4 Ig 31 g 4 g 5 Ig 41 gh 161 hh161

Q: Is there any reason why the number of adversaries armament referenced in the rule. The prescribed upgrade has not been specified? rule protective measures should limit the quantity and quality of the weapons and ordinance that can be introduced A: Yes. Threat analysis has shown that basing defense into a facility prior to initiation of the theft or sabotage capabilities on a predetermined number of postulated sequence.

adversaries can be misleading. Given the dynamic nature of the threat and the significance of behavior as well as resource Paragraph73.1(a)(2)

characteristics in determining adversary effectiveness, it was felt that protection against an adversary with a composite Q: Is it the intent of the conspiracy threat statement of characteristics across a spectrum of threat levels would that the physical protection system provide a capability to constitute a more prudent performance objective. prevent collusion between more than two insiders?

Paragraph 73.1 (a)( )(i) A: It is the intent of the regulations that those design features of the physical protection system that are affected Q: Is "hand-carried equipment" intended to include by the number of insiders in collusion be effective against toxic gases and antipersonnel ordinance? two colluding individuals. It is expected that some measure of protection will be afforded against larger colluding A: It is intended that the term "hand-carried" include groups as a result of those features designed to counteract incapacitating agents (tear gas, mace, tranquilizers, etc.) but two colluding individuals. Also, the larger the colluding not poisonous gases, and that adversaries will have available group, the higher the probability it will be detected.

to them antipersonnel ordinance (hand grenades, claymore mines, etc.). These two adversary attributes indicate that § 73.20 GeneralPerforranceObjective and Requirements unprepared guards or other response force personnel may be rendered ineffective either prior to engaging the Paragraph73.20(b)(2)

adversary or much more easily during the engagement. The attributes also imply that response force personnel must Q: What is the general scope of the "redundancy and have special equipment and receive special training to diversity" requirement?

counter these capabilities.

A: The physical protection system must be designed Paragraph73.1(a)(2) with redundant and diverse measures sufficient to ensure that the system will remain capable of providing the neces Q: Is there any special reason why the adversaries have sary level of protection under adverse conditions causing

"the ability to operate as two or more teams?" the failure of some elements of the system.

A: The ability to operate as two or more teams implies Redundancy means providing several measures (which that (1) the adversary may be able to split the response may be the same measure duplicated) to perform the same force into several groups, thereby reducing the firepower function or subfunction in order to prevent failure of the that the response forces can concentrate in any area during entire system on the failure of a single measure. The perform an engagement or (2) the adversary may be able to fix the ance of any given capability must not be so dependent on response force in one location by having one team engage any one measure that failure of that measure prevents the response force while another team maneuvers and adequate performance of the capability.

completes the theft mission. This adversary attribute has a potential impact on the number of response force personnel Diversity means providing different kinds or types of that may be required and the response tactics they may measures that contribute to the performance of a given employ. security function or subfunction. By providing various measures that have differing operating characteristics Paragraph73.1 (a)(J) and (a)(2) (sensitivities, failure modes, strengths, and weaknesses), the continued performance of a given capability is ensured Q: Do the knowledgeable individual who renders inside regardless of the failure of one such characteristic.

assistance and the conspirators possess the same adversary attributes as the "small group of external attackers"? An example of pure redundancy is the use of two microwave perimeter intrusion alarm systems installed in A: It is expected that anyone who supports the adversaries' parallel and provided with independent annunciators and actions will be capable of acquiring the same training as the power supplies. If one of the two microwave perimeter most sophisticated members of the adversary's group. intrusion alarm systems is replaced with' a fence-mounted However, because of the nature of the level of protec intrusion detection system, both redundancy and diversity tion required by these regulations it is not expected that have been achieved.

the single insider or the conspirators will'have available to them all of the weapons, ordinance, or special tools that are A more abstract example of redundancy and diversity considered the attributes of the "small group of external would be the use of a perimeter intrusion alarm system attackers." However, if the insider is a guard or perhaps (any technology) with a low-light-level (LLL) closed circuit an armed response individual, he may possess some of the protected area television surveillance system equipped

5.61-10

with a motion detection capability. For example, a primary Paragraph 73.20(b)(3)

perimeter intrusion detection system could be an infrared (IR) system and a redundant secondary capability would be Q: What is the intent of the need "to assure control over provided by the motion detection feature of the CCTV all activities and devices affecting the effectiveness, reliability, system. A tertiary intrusion detection capability would be and availability of the physical protection system"?

provided by manual observation of the CCTV monitors. A

fourth detection capability could be provided by the guard patrols. Diversity of the perimeter detection capability A: It is clear that such security devices as alarms and thus is provided by different types of technology used to CCTV must be tested and maintained to ensure reliability detect the intrusion. Further diversity is provided by the and availability. However, it is not so obvious, for example, fact that the LLL CCTV cameras may be designed to work that, if criticality alarms are activated falsely or illicitly, during the failure of the perimeter lighting system. they pose a significant problem to the integrity of the physical security system. This problem exists because these Paragraph73.20(b)(2) alarms create the impression of an emergency situation that requires emergency evacuations. These evacuations reduce Q: In what manner will the redundancy and diversity the level of protection for a period of time and provide requirement aid in the protection against the insider or the paths for adversaries to enter or exit the MAA and remove conspiracy threat? material through an unprotected portal. Therefore, the testing and maintenance program should ensure that such A: Whether the threat arises from an insider, a conspiracy, devices are kept in good working order and that illicit acti or outsiders, redundancy and diversity provides additional vities can not cause the effectiveness of the physical protec elements that must be overcome by the adversary to steal tion system to be impaired.

SSNM or commit radiological sabotage. These additional elements improve protection by requiring, for example, the Examples of activities that might cause criticality adversary to spend more time in learning system functions alarms to activate erroneously are (1)setting the detection and more time in attempting to disarm or compromise a threshold too low and (2) simulating an alarm condition on the signal lines.

series of systems instead of just one.

Paragraph73.20(b)(3) Examples of controls over the above activities that might reduce the probability that these erroneous alarms occur are (1) close supervision by knowledgeable security Q: What is the general meaning of the requirement of a

"testing and maintenance program to assure control ovei personnel of the calibration process and (2) placing critical activities and devices affecting the effectiveness, reliability ity alarms out of reach where possible, enclosing signal lines and availability of the physical security system" and "a in conduits, and tamper protecting detection circuitry.

demonstration that any defects of such activities ant devices will be promptly detected and corrected"?

Paragraph73.20(b)(3)

A: The physical protection system should include as Q: What are considered defects of activities and devices?

testing and maintenance program that addresses all element of the physical protection system and will ensure that al t A: Examples of defects in activities that affect the elements remain operating as they are supposed to and tha r reliability, effectiveness, and availability of the physical all elements will operate at all times , including unde confirn I protection system are (1) incomplete guard rounds, (2)

adverse conditions. Testing means procedures to the safeguards system ar4D improper vault opening or closing procedures, (3) escort that the individual measures of I duties that are not taken seriously, (4) delay in removal of performing as designed and intended and are, therefore snow from between perimeter infrared intrusion alarm

4.

providing the appropriate functions and capabilities f detectors that are in constant alarm, and (5)failure to Maintenance means not only the repair or replacement o e properly calibrate portal detectors.

hardware components, but also the review and possibl'

revision of orders establishing procedures that may. b Examples of defects in devices that affect the physical s

necessary to keep physical security systems and subsystem protection system are (1) tamper switches that stick in the operating effectively. closed or secure position, (2) alarm components that do not e alarm when they lose power, (3) signal lines that have line The testing and maintenance program should b failures or defects in safeguard Is supervision that is not functioning according to specifica designed to ensure that F. tions, (4) exterior equipment enclosures that fill with rain measures will be detected promptly and corrected promptl)

capabilities ar e and cause equipment failures because they are not properly Both preventive maintenance and repair or defects should not b e waterproofed, and (5) unacceptable degradation in detection needed. Correction of failures al performance of alarm systems because of other environ merely temporary fixes but should remedy the fundamenti t. mental conditions such as high winds.

problem and prevent a recurrence of the failure or defeci

5.61-11 I I

Paragraph73.20(b)(3) 73.45(c)(1)

73.45(eX!) and 73.45(eX2)

Q: What is a "demonstration that any defects.., will be 73.45(0(1) and 73.45(0(2)

• .. detected and corrected"?

Paragraph73.45(b)

A: Examples of effective demonstrations would be procedures that (1) cause tamper switches to be physically Q: Why doesn't this capability statement also include a activated, (2) cause alarm systems to actually operate on requirement for preventing unauthorized access of persons emergency power, and (3) measure line supervision tolerances. and materials into the protected area?

Paragraph73.20(b)(3) A: Because it has been determined that it is not always possible to prevent the unauthorized access of materials or Q: Does the requirement for a testing program imply the persons into the protected area (PA). Materials can be need for adversary type testing? passed through or thrown over PA barriers, and an external group can penetrate the barriers before the response force A: Testing does not imply that the licensee should has sufficient time to reach the point of penetration. The conduct exercises in which individuals assume the roles and PA barrier forms only the first of a series of defense-in characteristics of adversary groups and attempt to commit depth systems the adversary must compromise in order to adversary actions. Drills in which an alarm is sounded (but effect SSNM theft or sabotage.

for which there is no simulated adversary) and the security force's response times and knowledge of contingency plans Paragraphs73.45(b)(1) and (bJ(2)

are demonstrated constitute an appropriate and effective test method. The manner in which the alarm is caused to Q: Paragraph 73.45(bX I) is concerned with adversaries sound can be used to test its sensitivity, and the location of who attempt to gain access or introduce material across the alarm selected can be used to test the adequacy of the MAA or VA boundaries using stealthful or forceful tactics.

alarm display and assessment functions. Is it not reasonable to speculate that adversaries might consider the use of stealth or force to introduce unautho Paragraph73.20(c)(2) rized materials or gain unauthorized access into an MAA or VA through entry control points?

Q: What activities constitute "new construction, signif icant physical modification of existing structures or major A: The boundaries referred to in the rule include the equipment modifications," and what kind of evidence that entry control points for the purposes of stealth or force.

these activities are actually being planned is necessary to permit a delay in implementation to be authorized? Paragraph73.45(b)(2)

A: The intent of this provision is to permit a delay in Q: How do "entry criteria" differ from "authorization implementing those safeguards measures that require controls and procedures" and "authorization schedules"?

lengthy procurement, installation/modification/construction periods, and testing before they can become an inte A, Detecting attempts to gain unauthorized access into gral part of the physical protection system. The licensee MAAs or VAs by deceit will require the establishment of should 4be prepared to show proof, if requested, in the form access authorization controls and procedures to provide of signed contracts that clearly indicate the dates of delivery current authorization schedules and entry criteria for or completion of the subject components or measures, and both persons and materials. Access authorization controls the name and address of the vendors and contractors. For and procedures constitute the administrative process of every measure in which there is an implementation delay, determining which persons and materials have a legitimate temporary measures that achieve a comparable level of need to enter a given MAA or VA and at what time or protection will be expected. under what conditions this need exists. Current authoriza tion schedules will document for entry control personnel'

§ 73.45 PerformanceCapabilitiesfor Fixed Site Physical which persons and materials are authorized access and the Protection &stenm times or conditions for such authorized access. Entry criteria are the aggregate of many pieces of information to Q: Is it necessary for some capabilities to be maintained be considered or checked in determining whether or not a during both normal and emergency conditions? Which ones person or material is authorized entry to that MAA or VA

are they? at that time or under those circumstances.

A: The following paragraphs contain requirements to Paragraph73.45(b)(2)(ll)

maintain the expressed capabilities during both normal and emergency conditions: Q: What is the intended meaning of the requirement to verify the identity of materials prior to introduction into an

73.45(bX1) and 73.45(bX2) MAA?

5.61-12

A: This requirement Is Intended to ensure that all movements of SSNM (which should be done in concert materials entering an MAA are searched for contraband and with the physical protection system) and (2) providing that comparisons of shipping documents with package procedures for informing the physical protection system of identification and authorization schedules are made. In current authorizations for placement and movement of

2 the case of receipts of SSNM, this requirement does not materials within the MAA. This includes the receipt of imply that the packages of SSNM presented for entry into shipments through MAA portals. Licensees should review the MAA must be opened and the SSNM scrutinized, their fundamental nuclear material control (FNMC) plans weighed, and analyzed at the entry point by security and submit appropriate revisions to them to ensure that the personnel. Authorization to receive this material must be above mentioned activities are covered in their plan.

transmitted to entry control security personnel through channels independent of the shipper. SSNM content may be Paragraph73.45(e)

verified by matching information on the shipping documents with that on the containers. Also required would be some Q: What is the intended meaning of the term "confirmed form of verification that the package has not been opened forms and amounts"?

or its integrity otherwise compromised. This can be accom plished by the examination of both the container and the A: Confirming the properties and quantities of material tamper-indicating devices affixed to it. presented for removal, that is, establishing that the material presented for removal is in fact what it is purported to be, Paragraph73.45(c) does not imply that the packages of SSNM presented for removal from the MAA must be opened and the SSNM

Q: What is meant by "unauthorized activities and scrutinized, weighed, and analyzed at the exit point by conditions"? security personnel. Confirmation does require controls on the packaging, measurement of contents, and sealing A: The intent of this capability is to ensure that proce of containers prior to removal. Alternative methods of dures that are consistent with sound security practices are controlling, packaging, measurement, and sealing are maintained within the MAAs and VAs. The focus is on the discussed in Regulatory Guide 5.57. Controls also should security system detecting, primarily through surveillance, include procedures that permit the exit control security activities and conditions that threaten the security posture personnel to determine that the package does in fact within the MAA. Unauthorized conditions include such contain the material listed on the packing document. This things as vent grills out of place, holes in walls, and vault may be accomplished by matching the information on the doors open when not necessary. Unauthorized activities are documents accompanying the SSNM with information on those that would leid to unauthorized conditions if the other documents prepared by MBA or ICA personnel or

~j activity is not terminated. other personnel who certified the packaging of the material.

These documents are transmitted to the exit control Paragraph73.45(d) personnel through channels beyond the control of the individuals making the removal. Also required would be Q: Is it the intent of this paragraph to bring about some form of verification that the package has not been substantial changes in material control and accounting opened or .its integrity otherwise compromised since the practices? MBA or ICA personnel or inspectors certified the contents.

This can be accomplished by the use of packaging containers A: The intent of this paragraph is primarily to ensure of such design that their structural integrity (or lack thereof)

that strategic special nuclear material is located within an is readily apparent and that are sealed with tamper-Indicating MAA and to recognize that certain uses of the material seals (see Regulatory Guide 5.10, " Selection and Use of within the MAA may need to be physically separated to Pressure-Sensitive Seals on Containers for Onsite Storage of make unauthorized removal more difficult. For example, Special Nuclear Material," and Regulatory Guide 5.15, materials directly usable in a clandestine fission explosive "Security Seals for the Protection and Control of Special should be stored in a vault when not actively undergoing Nuclear Material"). Checks on seals should include both processing, while fuel elements, fuel assemblies, and certain seal integrity and seal identification.

other materials need not be afforded the same degree of protection because of their form. Furthermore, areas such Paragraph73.45(e)

as processing and packaging areas where the material is handled should be controlled separately to provide addi Q: Is it the intent of this capability statement that only tional help in preventing unauthorized removal of the the modes of stealth and force will be used by adversaries material. A physical protection system can accomplish the to remove SSNM through the MAA boundary and that only intent of this paragraph by performing surveillance activities deceit will be used to remove SSNM through the MAA

to detect gross occurrences of unauthorized movement portal?

and placement of SSNM. This is not intended to be a sophisticated control of small quantities of SSNM that A: As with other provisions of the rule, the major would be a material control and accounting function. concern is for stealthful and forceful attempts to penetrate Material control and accounting practices can, however, the MAA boundary (barriers) and deceitful attempts to pass assist in achieving this capability. These practices help to through the portal. An adversary using stealth or force to accomplish this by (1) defining authorized placements and remove material through a portal would probably select an

5.61-13 II ,I

emergency exit before he would select an exit control A: It is similar, although the emphasis is on detection point. However, removal by stealth or force through normal rather than prevention. This requirement is intended to entry control points should be considered in the design and detect individuals penetrating the PA or introducing unautho operation of the portal. It is also conceivable that an adversary might attempt to pass SSNM around an SSNM

rized materials or vehicles through PA portals. Therefore, specific authorization for such access must be presented to K

detector by using stealth; however, it is expected that the the security guards. This capability will ordinarily be portal design would prohibit this. accomplished by intrusion sensors, guard patrols, and remote assessment of the PA boundary and through person Paragraph73.45(e) nel and vehicle searches at the portals.

Q: What is the distinction between the activities of § 73.46 Fixed Site PhysicalProtection Systems, Subsys

"authorization" and "verification"? tems, Component:, and Procedures (Reference System)

A: Authorization determines what is to be permitted Paragraph73.46(a)

and must occur before the act of verification. Verification is the process of determining whether what is happening is Q: Why are the systems, subsystems, components, and or is not authorized. procedures delineated in § 73.46 included in the Physical Protection Upgrade Rule if there are already general perform Paragraph73.45(e) ance and capabilities requirements?

Q: Is it the intent of this requirement to make changes A: The level of detail in paragraphs 73.46(b) through in material control and accounting practices? 73.46(h) is included in order to present examples of the types of systems, subsystems, components, and procedures A: Compliance with this paragraph may require changes that would normally be included in a physical protection in licensee material control and accounting practices and system having the level of performance required of that hence their FNMCs. Measurement and packaging of SSNM system in order to be licensed. The required level of perform is ordinarily performed by either operational or material ance is specified in § § 73.20 and 73.45.

control and accounting personnel. However, controls that ensure that two people have attested to the contents and Paragraph 73.46(a)

witnessed the application of the tamper-indicating seal, for example, may need to be instituted in advance to levy Q: Is there a reference specification provision in § 73.46 an overall internal control system to meet the intent of the for every capability requirement in § 73.45?

regulation. Although Part 70 presently has requirements for tamper-indicating seals, the purpose was to allow the use A: Table I in Section B of this guide demonstrates that of a previous measurement for accountability purposes. In there is at least one example provision in § 73.46 for every this requirement, the intent is to prevent the theft of SSNM capability requirement in § 73.45. Usually, there are both by a single individual and through collusion. Therefore, several provisions in § 73.46 that apply to each requirement additional control over the seals and the seal records in § 73.45. A more detailed discussion of the relationship may be needed. For example, procedures to provide copies between these provisions can be found in Section B.4. of of the seal log to exit control individuals might be developed this guide.

to ensure that two individuals have attested to the contents and witnessed the affixing of the seal and that both of these individuals did not participate in transferring the material Paragraph 73.46(b)(2)

to the exit control point.

Q: What is the meaning of the phrase "members of the Paragraph73.45(e)(2) security organization with authority to direct the physical protection activities"?

Q: Why not confirm the identity and quantity of strategic special nuclear material "authorized" (rather than "presented") A: The meaning of the phrase is that someone with for removal from a material access area? specifically designated authority and a member of the security organization, e.g., the Director of Security or the A: The concern is whether material 'presented" for removal security shift supervisor, must be onsite at all times and conforms with the identity and quantity of SSNM "autho ready to direct the necessary physical protection activities.

rized" for removal. "Confirmation" occurs at the time the material crosses the MAA boundary. "Authorization" must Paragraph73.46(b)(2)

occur before the material is moved to the MAA boundary.

"Confirmation" should be conducted immediately before Q: What is the meaning of the term "physical protection departure of the material to preclude tampering. activities"?

Paragraph73.45(f) A: The term includes the full spectrum of activities from normal guard force duties, through immediate actions Q: Is the intent of this requirement similar to the MAA required by a secutrity breach, to reaching response forces and VA access controls called for in paragraph 73.45(b)? and obtaining necessary assistance.

5.61-14

response force with this capability could be an appropriate Paragraph73.46(b)(3)(i)

mix of onsite and offsite personnel.

Q: What is the meaning of the term "other individuals Paragraph73.46(c)(5)(fii)

responsible for security"?

Q: Does the term "significant delay to penetrations"

A: Other individuals are such management personnel as mean that this MAA barrier must be more formidable than guard supervisors, response personnel who are not members those surrounding alloys, fuel elements, or assemblies?

of the guard force, plant security directors, and plant personnel directors.

A: Yes. The purpose of this provision is to make it difficult for a conspiracy of individuals within the MAA to Paragraph73.46(b)(3)uii)

breach the barrier without being detected and transfer SSNM to the outside.

Q: Who is the "individual with overall responsibility for the security functions"? Under this provision, all openings in the MAA barrier, such as areas under doors, through-fans, ventilation ducts, A: Generally, the individual to whom overall facility and pipe passthroughs, that lead to an accessible area security responsibility is delegated is a corporate Vice outside the MAA should be completely closed off or President, Plant Manager, or the Plant Director for Security.

specially protected. In addition, the barrier should be constructed of a material that resists cutting, drilling, and Paragraph73.46(b) (4)

'puncture by small hand tools or tool substitutes. Where possible, all operations at a facility involving SSNM that Q: Does this provision mean that licensees must submit has not been alloyed or encapsulated should be consolidated separate plans to implement the requirements of Appen in a single location that meets this barrier provision.

dix B to Part 73?

Barriers should be inspected at regular intervals to A: Separate plans will be required to implement the ensure that a breach is not in process.

requirements of Appendix B to Part 73, although these should be related to and coordinated with the security plan The secondary intent of this provision is to provide prepared in accordance with the provisions of the Physical Protection Upgrade Rule. additional protection of unalloyed and unencapsulated SSNM in process against external assault.

Paragraph73.46(c)(2) Paragraph73.46(c)(S)(iv)

Q: Are vehicle barriers required along the PA perimeter?

Q: Does the term "except when personally attended"

mean that components and process equipment containing A: No. It is- not the intent of the regulations to require a SSNM do not need to be locked as long as someone is in the PA barrier capable of resisting a forceful entry attempt MAA?

using a vehicle.

A: No. The only SSNM that does not need to be under Paragraph 73.46(c)(5)

lock is that being processed, handled, worked on, or directly observed by personnel.

Q: Does "strategic special nuclear material, other than alloys, fuel elements or fuel assemblies" mean all SSNM Paragraph73.46(d)(1)

that is in the form of powder, liquid, or gas?

A: Yes, it includes SSNM in solid, liquid, or gaseous Q: What type of escort is required for a non-employee states. entering an MAA or VA?

A: Non-employees who require occasional access to an Paragraph73.46(c)(5)(i)

MAA or VA should be escorted by either a member of the security organization or a licensee employee who has Q: Must the penetration time of the vault equal local law current authorization to enter that MAA or VA.

enforcement response time or response time of the facility response force? Paragraph73.46(d)(6)

A: The penetration time should either be equal to or Q: Is use of x-ray for package search required by the greater than the amount of time necessary to deploy a rule?

response force capable of containing and preventing removal of SSNM from the facility by the external assault threat (a A: No. X-ray is an acceptable method of conducting small group, well trained, well equipped, able to operate as package searches but is not the only method. Substantial two or more teams, etc.). Depending on site conditions, the

61-15 I~.l ~ I;

technical guidance on alternative methods to accomplish A: Not in all cases. Guidelines on appropriate CCTV

package searches are contained elsewhere in the Physical configurations are provided in NUREG/CR-0543, "Central Protection Upgrade Rule Guidance Compendium.

Alarm Station and Secondary Alarm Station Design," and in NUREG-Ol78, "Basic Considerations for Assembling Paragraph73.46(d)(8) CCTV," both of which are contained in the Physical Protection Upgrade Rule Guidance Compendium.

Q: Must a member of the guard force provide escort to personnel or vehicles that require an escort to enter the PA Paragraph73.46(e)(7)

or may a designating escort be used?

Q: Does the requirement that the status of all alarms and A: A member of the security force should escort vehicles alarm zones be indicated in the alarm station mean that entering the PA. Individual pedestrians may be escorted both the central alarm station (CAS) and the secondary within the PA by either a member of the security force or a alarm station (SAS) have identical annunciation and alarm licensee employee who has current authorization to enter control (access, secure, test) capabilities?

the PA.

A: A discussion of which capabilities should be duplicated Paragraph73.46(d)(9) between CAS and SAS and how and where to accomplish this is discussed in NUREG/CR-0543, "Central Alarm.

Q: To meet the need for dual exit searches from MAAs, Station and Secondary Alarm Station Design," contained in may one of the searches be a visual search or must both use the Physical Protection Upgrade Rule Guidance Compendium.

electronic detectors, etc.?

Paragraph73.46(e)(7)

A: Visual searches are not considered sufficient to detect small quantities of concealed SSNM. Electronic SNM Q: Is the intent of the rule to require a display board in detectors should be used for both searches. the CAS/SAS indicating the status of each alarm with a visual display?

Paragraph 73.46(d)(9)

A: The intent is that the status of each alarm can be Q: What normally would constitute an acceptable independently determined in real time at each alarm random search? station, i.e., no "summary alarms."

A: A technique that ensures that each individual could Paragraph73.46(g)

be selected for search each and every time the individual leaves the material access area. Q: What is the meaning of the term "other physical protection related devices"?

Paragraph73.46(d)(14)

A: Examples of devices included in this term are:

Q: Does the definition of "termination of employment"

include employees who have been transferred to another

"* Emergency power sources work site? "* Lighting, normal and emergency

"* CCTV surveillance systems A: Yes, it is intended that changes to keys, locks, "* Weapons and other guard equipment combinations, and other related equipment should be made whenever an employee is transferred to another work site.

"* Security vehicles

"* Electronic access control devices

"* Search equipment Paragraph73.46(e)(3) "* Duress alarms Q: Does the requirement that an individual other than Paragraph73.46(g)(5)

the alarm station operator have knowledge of the opening of unoccupied vaults or process areas indicate that the Q: Does the provision for "two individuals working as a individual may be notified some time in advance of the team who have been trained in the operation and perform opening? ance of the equipment" mean the electrician and his apprentice or two separate electricians who do not normally

. A: No. The individual should witness the opening, either work together?

directly or through an assessment mechanism such as CCTV. A: The two individuals could be any employees of the licensee or agents or contractors of the licensee who meet Paragraph73.46(e)(3) all other requirements for access. Both should be trained in the operation and performance of the security equip Q: Is one monitor per each remote CCTV camera ment involved to the extent that each could detect an required in the CAS and SAS? unauthorized alteration of the system by the other.

5.61-16

Paragraph 73.46(gk(5) manning the alarm stations have continuing duties in case of an assault and are not considered to be part of the response force.

Q: Do "performance verification tests" differ from

"operational tests"?

Paragraph73.46(h) (6)

A: Performance verification tests are an abbreviated Q: What are some of the measures that can be used to form of operational tests. Operational tests are rigorous and

"facilitate the initial response to detection of penetration systematic tests conducted on every zone of every alarm of the protected area and assessment of the existence of a system at prescribed intervals. Performance verification threat"?

tests involve testing the performance characteristics of only those functions that were likely to be affected by the maintenance activities in question. A: To facilitate prompt assessment and initial response to the detection of questionable activity at or in the vicinity Paragraph73.46(g)(6) of the protected area perimeter, a capability of observing the isolation zones and the physical barrier should be provided. Such means as closed-circuit television (CCTV),

Q: Does the provision for "individuals independent of hardened observation posts, armored response vehicles, and both security management and security supervision" mean various combinations of these might be used. The employ that someone outside the security program must conduct the review? ment of such physical security systems should be governed by the following considerations.

A: Yes, the intent is to have a management review by

1. CCTV. Coverage should include the entire perim persons other than those responsible for the security eter, isolation zones, and, to the extent possible, the clear programs.

areas between barriers. Cameras on remotely controlled pan Paragraph73.46(h)(3) and tilt mechanisms may be used for optimum effec tiveness. If, however, fixed position cameras are used, the field of view normally would not need to extend beyond Q: What is the minimum composition of the response the isolation zones. Such limitation should allow concentra force and other armed personnel that should be available to tion within the areas of primary concern. Low-light-level cope with safeguards contingencies?

CCTV cameras are most desirable for this purpose owing to their effectiveness during periods of reduced visibility.

A: This provision envisions five armed guards totally committed to the physical security effort being available

2. Hardened Observation Posts. Hardening should be for response and assessment of safeguards contingencies.

to a level at least equivalent to that of the alarm stations.

The number of "additional" guards or other appropriately Such posts should be located so that an unobstructed view trained (in accordance with Appendix B) and armed personnel of the perimeter and isolation zone that is supposed to be who must also be available for backup cannot be predeter monitored is available. The posts should also have direct mined on a generic basis. This must be done on a site-by-site communication and alerting capability with the alarm basis, giving due consideration to such factors as (1) the stations, including duress alarms, in order to avoid delay in size, location, competence, and reliability of the local the transmission of information concerning any threatening law enforcement agency; (2) the ease or difficulty with event.

which the site can be approached undetected; (3) the ease with which escape from the site can be made; and (4) the

3. Armored Response Vehicles. Such vehicles should general attitude of the local population toward the site and be armored to a level at least equivalent to that of the alarm its management. These are the kinds of considerations that stations. They should be capable of reaching a defensive should influence the licensee's determination of the number position at any part of the perimeter barrier. Response to of available armed personnel as expressed in the physical such a position must be sufficiently rapid to prevent protection plan.

intruders from reaching and breaching a second barrier Paragraph73.46(h)(3) without direct visual contact and opportunity for confronta tion by the response force. The vehicles should be equipped Q: May guards and armed response personnel have other with duress codes that can be easily activated through the mobile radio.

duties or must they be dedicated to the response function?

Assessment is a continuing process of evaluating the A: Guards and armed response personnel can have other security situation and deciding whether or not conditions duties as long as such duties do not interfere with their that dictate the initiation of a response exist. The assessment response to a safeguards contingency. Normally, it is expected that the response force would be made up of functions of security personnel and systems such as that described above are important to the achievement of the guards who have routine duties other than response, other objectives of a perimeter protection system. Personnel members of the licensee's organization who are qualified selected for any of the positions that have an assessment and trained in accordance with Appendix B, and guards role (e.g., observation posts and alarm stations) should be from the licensee's organization who may be located at a highly competent and dependable. Furthermnore, they facility that is adjacent to the protected are

a. Guards

5.61-17

should have the unquestionable authority to alert the guards from having access to material access areas and the response force and, in the case of those within the alarm SSNM. A possible alternative would be to use a team of stations, to request assistance from offsite forces. personnel (more than two) to investigate the source of the Paragraph 73.46(h)(7)

alar

0. IMPLEMENTATION

Q: Why are security personnel assessing alarms within unoccupied vaults and unoccupied material access areas This section provides information to applicants and containing unalloyed or unencapsulated SSNM required to licensees regarding the staff's plans for using this regulatory use only remote means to assess these alarms? guide.

A: There are two reasons for this provision. First, to Except in those cases in which the applicant proposes an maintain the designed delay time built into vaults, the acceptable alternative, after publication of this guide the doors should be kept closed and locked, especially at night Commission's staff will use the intents and understandings and during off shifts. The remote assessment would preclude described herein as one aid for evaluating an applicant's or an adversary from intentionally using a false alarm as a licensee's capability to conform to the performance-oriented means of getting the vault opened. Second, the use of physical protection requirements in the Physical Protection remote assessment techniques prevents the two responding Upgrade Rule.

5.61-18

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON. 0. C. 20555 POSTAGE AND FEES PAIO

OFFICIAL BUSINESS U.S. NUCLEAR RrGULATOVY

PENALTY FOR PRIVATE USE. $300 COMMISSION

K