NUREG-2264, Responses to Public Comments on Guidance Documents for Final Enhanced Weapons Rule (RG 5.62, RG 5.86, RG 5.87, and Wsa NUREG-2264)

Responses to Public Comments on Guidance Documents for Final Enhanced Weapons Rule (RG 5.62, RG 5.86, RG 5.87, and Wsa NUREG-2264)

ML17123A319
Person / Time
Issue date:	03/07/2023
From:	Phil Brochman NRC/NSIR/DPCP
To:
Brochman P
Shared Package
ML22287A156	List: ML22287A158 NUREG-2264, Responses to Public Comments on Guidance Documents for Final Enhanced Weapons Rule (RG 5.62, RG 5.86, RG 5.87, and Wsa NUREG-2264)
References
10 CFR Part 73, NRC-2011-0014, NRC-2011-0015, NRC-2011-0017, RIN 3150-AI49
Download: ML17123A319 (45)

Text

U.S. NUCLEAR REGULATORY COMMISSION Responses to Public Comments on Regulatory Guidance Documents Supporting the Final Rule on Enhanced Weapons, Firearms Background Checks, and Security Event Notifications NRC-2011-0014; NRC-2011-0015; NRC-2011-0017; RIN 3150-AI49 U.S. Nuclear Regulatory Commission Office of Nuclear Security and Incident Response Office of Nuclear Reactor Regulation Office of Nuclear Material Safety and Safeguards Office of Nuclear Regulatory Research March 2023 Technical Lead: P. Brochman, NSIR Project Manager: S. Schneider, NMSS ML17123A319

ii This page intentionally blank.

iii TABLE OF CONTENTS LIST OF ACRONYMS................................................................................................................. iv INTRODUCTION.......................................................................................................................... 1 Summary.................................................................................................................................. 1 Public Meetings....................................................................................................................... 2 Discussion............................................................................................................................... 2 Comment Overview................................................................................................................. 4 Comment Grouping................................................................................................................. 7 RESPONSES TO SPECIFIC COMMENTS.................................................................................. 7 A.

Group A - General Comments.................................................................................... 7 B.

Group B - Regulatory Guide 5.62............................................................................... 7 C.

Group C - Regulatory Guide 5.86............................................................................. 32 D.

Group D - Regulatory Guide 5.87............................................................................. 34 E.

Group E - Weapons Safety Assessment..................................................................... 37

iv LIST OF ACRONYMS ADAMS Agencywide Documents Access and Management System AEA Atomic Energy Act of 1954, as amended ATF Bureau of Alcohol, Tobacco, Firearms and Explosives CAA controlled access area CAP Corrective Action Program CFR Code of Federal Regulations CIKR Critical Infrastructure and Key Resource CJIS FBIs Criminal Justice Information Services Division CSEN Cybersecurity Event Notification CY calendar year DCJS Department of Criminal Justice Services DG draft regulatory guide DHS U.S. Department of Homeland Security DOE U.S. Department of Energy FAA Federal Aviation Administration FBI Federal Bureau of Investigation FFL federal firearms license FRN Federal Register notice GTCC greater than Class C waste ILTAB Intelligence Liaison and Threat Assessment Branch (NRC)

ILTAT Intelligence Liaison and Threat Assessment Team (NRC-Region IV)

ISFSI independent spent fuel storage installation JTTF Joint Terrorism Task Force LLEA local law enforcement agency MAA material access area MILES multiple integrated laser engagement system NFA National Firearms Act of 1934 NFAD ATFs National Firearms Act Division NEI Nuclear Energy Institute NICS National Instant Criminal Background Check System NPUF non-power production or utilization facility NRC U.S. Nuclear Regulatory Commission NTN NICS transaction number NUREG NRC technical report designation series document PA protected area

v RD restricted data SEL Safeguards Event Log SNF spent nuclear fuel SNM special nuclear material SSNM strategic special nuclear material TTRG Terrorist Threats to the U.S. Homeland Reporting Guide for Critical Infrastructure and Key Resource Owners and Operators TVA Tennessee Valley Authority USACE U.S. Army Corps of Engineers VA vital area VAF voluntary appeal file WSA Weapons Safety Assessment

1 INTRODUCTION Summary This document presents the U.S. Nuclear Regulatory Commission (NRC) responses to written public comments received on the regulatory guidance documents supporting the final rule on Enhanced Weapons, Firearms Background Checks, and Security Event Notifications (hereafter the enhanced weapons) [RIN 3150-AI49]. The NRC published a proposed rule on February 3, 2011, in the Federal Register (76 FR 6200) for public comment with a 180-day public comment period. The NRC also published on the same day in the Federal Register separate notices (76 FR 6085, 76 FR 6086, and 76 FR 6087) for public comment on supporting guidance documents for the same 180-day period. These guidance documents included draft regulatory guides (DG)-5019, Revision 1,1 and DG-5020, Revision 0,2 and a draft weapons safety assessment (WSA).3 On January 10, 2013, the NRC published a first supplemental proposed rule (78 FR 2214); however, no changes to the supporting guidance documents were made. On September 22, 2015, the NRC published a second supplemental proposed rule (80 FR 57106) which also contained a request for comment on revised regulatory guidance document DG-5020, Revision 1.4 This document identifies how the NRC dispositioned public comments received on these supporting draft guidance documents for the following final guidance documents.

Regulatory Guide (RG) 5.62, Revision 2, Physical Security Event Notifications, Reports, and Records,(NRC Agencywide Documents Access and Management System (ADAMS) [ML17131A285]).

RG 5.86, Revision 0, Preemption Authority, Enhanced Weapons Authority, and Firearms Background Checks, (ML17131A296).

RG 5.87, Revision 0, Suspicious Activity Reports Under 10 CFR Part 73 (ML17138A384).

NUREG-2264, Revision 0, Weapons Safety Assessment, Volumes 1 - 4, (ML18108A014).

In developing these final guidance documents, the NRC considered all the comments received on the 2011 proposed rule, the 2013 and 2015 supplemental proposed rules, and the 2011 and 2015 draft guidance documents. If a public comment resulted in a change to the supporting guidance documents, the NRCs comment response indicates what was changed and where the change occurred. The NRCs responses to written public comments received on the proposed rule and the two supplementary proposed rules are provided in a separate comment response document (ML16264A004). Accordingly, this comment response document only addresses written public comments on the associated guidance documents.

1 DG-5019, Revision 1, Proposed Revision 2 of RG 5.62, Reporting and Recording Safeguards Events, (ML100830413).

2 DG-5020, Revision 0, Applying for Enhanced Weapons Authority, Applying for Preemption Authority, and Accomplishing Firearms Background Checks Under 10 CFR Part 73, (ML100321956).

3 USACE PDC NRC TR 06-10.1 to 10.3, Draft Weapons Safety Assessment, Volumes 1 to 3, (redacted ML103190273). USACE PDC NRC TR 06-10.1 to 10.5, Draft Weapons Safety Assessment, Volumes 1 to 5 (U)

(non-public ML103190271).

4 DG-5020, Revision 1, Applying for Enhanced Weapons Authority, Applying for Preemption Authority, and Accomplishing Firearms Background Checks Under 10 CFR Part 73, (ML14322A847).

2 The public comment submissions on these guidance documents and the proposed rule may be found at the Federal e-Rulemaking Website at https://www.regulations.gov/ under Docket ID Nos. NRC-2011-0014, NRC-2011-0015, and NRC-2011-0017; and NRC-2011-0018, respectively. Electronic copies of these final RGs and NUREG are available through the NRCs public Web site in the NRC Library at https://www.nrc.gov/reading-rm/doc-collections/, under Document Collections, in Regulatory Guides or in NUREG-Series Publications. These RGs and NUREG are also available through ADAMS at https://www.nrc.gov/reading-rm/adams.html.

Finally, the regulatory analysis for these documents may be found under ML19045A003.

Public Meetings On June 1, 2011, the NRC staff held a public meeting at NRC Headquarters to discuss the enhanced weapons proposed rule and the supporting regulatory guidance documents with the public, licensees, and other stakeholders (see meeting summary at ML111720007). On November 19, 2015, the NRC staff held a further public meeting at NRC Headquarters to discuss the 2015 second supplemental proposed rule, the revised supporting regulatory guidance documents, and the implementation period (i.e., the compliance dates) for the final rule (see meeting summary at ML15348A082).

These meetings provided the participants with a more complete understanding of the proposed rule, the supporting guidance documents, and planned implementation schedules. The NRCs intent was to enable these stakeholders to submit more informed comments on the proposed rule, supplements to the proposed rule, and supporting draft guidance documents.

Discussion DG-5019 Public comment submissions received on DG-5019, Revision 1, may be found under Docket ID No. NRC-2011-0014 at the Federal e-Rulemaking Website at https://www.regulations.gov/.

DG-5019, Revision 1, contained guidance regarding 1) physical security event notifications, written follow-up reports, and records; 2) cyber security event notifications, written follow-up reports, and records; and 3) suspicious activity reports. However, in developing the final rule, the NRC bifurcated the physical security event notification and the suspicious activity reporting requirements into separate regulations.5 6 Consequently, NRC staff also bifurcated the supporting final guidance documents as follows: RG 5.62, Revision 2, addresses physical security event notifications, written follow-up reports, and recordkeeping; and RG 5.87, Revision 0, addresses suspicious activity reporting.

Additionally, the NRC also developed a separate final rule on cyber security event notifications that was published in a Federal Register notice (80 FR 67264; November 2, 2015).7 The NRC in this notice also issued separate supporting guidance for cyber security event notifications in RG 5.83, Revision 0, Cyber Security Event Notifications. Consequently, cyber security event 5 10 CFR 73.1200, 73.1205, and 73.1210 contain requirements on physical security event notification, reports, and recordkeeping, respectively, for licensees subject to 10 CFR Part 73, Physical Protection of Plants and Materials.

6 10 CFR 73.1215 contains requirements on suspicious activity reporting for licensees subject to 10 CFR Part 73.

7 10 CFR 73.77 contains cyber security event notification, reports, and recordkeeping requirements.

3 notifications are not included in RG 5.62, Revision 2. The NRCs responses to public comment submissions on the cyber security event notification supporting guidance in DG-5019 are included in the final cyber security event notifications rule Federal Register notice beginning on page 67270.

DG-5020 Public comment submissions received on DG-5020, Revision 0 and Revision 1, may be found under Docket ID No. NRC-2011-0015 at the Federal e-Rulemaking Website at https://www.regulations.gov/. Revision 0 was issued for public comment with the 2011 proposed rule and Revision 1 was issued with the 2015 supplemental proposed rule. DG-2020, Revisions 0 and 1, contained guidance regarding applying for stand-alone preemption authority, applying for combined preemption authority and enhanced weapons authority, conducting firearms background checks, and other implementing provisions associated with the possession and use of enhanced weapons. For example, guidance on enhanced weapons inventory, transfer, transportation, and recordkeeping provisions. Accordingly, RG 5.86 provides guidance regarding the application for these authorities under 10 CFR 73.15 and 73.17,8 9 accomplishing firearms background checks, and associated implementing provisions (e.g., receipt, transfer, transportation, and inventory of enhanced weapons).

Draft Weapons Safety Assessment Public comment submissions received on the draft WSA may be found under Docket ID No.

NRC-2011-0017 at the Federal e-Rulemaking Website at https://www.regulations.gov/. The draft WSA was developed under contract to the NRC by the US Army Corps of Engineers (USACE)

Protective Design Center (PDC) and used the identifiers USACE PDC TR NRC 06-10.1 through 06-10.5 for the five volumes of this document. Volumes 06-10.1 through 06-10.3 were publicly available for comment. However, Volumes 06-10.4 and 06-10.5 contained sensitive weapons technical information and were limited to only stakeholders with a need to know. Accordingly, NUREG-2264 provides guidance on accomplishing a weapons safety assessment as part of an application for combined preemption authority and enhanced weapons authority. While licensees applying for such authority are required to complete a WSA, they do not have to use the template process contained in this NUREG. NUREG-2264 consists of four volumes:

Volume 1 contains instructions on completing the template, Volume 2 contains the template, Volume 3 contains guidance for the NRC staff to evaluate a completed template, and Volume 4 is an example of a completed template for a hypothetical reactor facility.

The draft WSA volumes set forth a process for use by an applicant may choose to use as part of an application for combined preemption authority and enhanced weapons authority. The information in a WSA is used by an applicant to evaluate the potential onsite and offsite safety hazards, safety impacts, or safety risks and any onsite security risks that could arise from the potential use of enhanced weapons (e.g., machine guns) as part of a licensees protective strategy for defending against malevolent acts. Based on its assessment of these hazards, impacts, or risks, an applicant can identify preventive or mitigative measures that it intends to 8 10 CFR 73.15, Authorization for the use of enhanced weapons and preemption of firearms laws.

9 10 CFR 73.17, Firearms background checks for armed security personnel.

4 implement upon the deployment of enhanced weapons. However, an applicant may choose to use its own process for completing a WSA, rather than the template in Volume 2 of the NUREG.

Comment Overview The NRC received 18 comment submissions on the 2011 proposed rule, the two supplemental proposed rules, and the supporting guidance documents (DG-5019, Revision 1; DG-5020, Revision 0, and the draft Weapons Safety Assessment). No comments were received on DG-5020, Revision 1. In the comments and NRC responses below, DG-5019, Revision 1, has been shortened to DG-5019; and DG-5020, Revision 0, has been shortened to DG-5020.

The individual comment submissions are identified in Table 1 below and may be found in ADAMS under their respective accession numbers as specified in Table 1. Of these 18 comment submissions, 15 submissions were on the proposed and supplemental proposed rules and were made by 13 individuals or organizations. Two individuals or organizations submitted comments on both the 2011 proposed rule and the 2015 supplemental proposed rule. Five of these 18 comment submissions were on the supporting guidance documents and were made by 5 individuals or organizations. Three individuals or organizations submitted comments on both the 2011 proposed rule and the supporting guidance documents.

In addition, the NRC also received a request to extend the public comment period on the 2011 proposed rule. However, because this extension request did not contain any comments on the proposed rule text, Statement of Considerations, or any responses to specific questions, the NRC has not included this request in the comment submissions listed in Table 1.

The NRC has compiled and annotated a complete list of these public comment submissions in a single document, Annotated Public Comments on: Enhanced Weapons, Firearms Background Checks, and Security Event Notifications Rule and Supporting Regulatory Guidance Documents, (ML22287A158). The NRC reviewed and annotated the comment submissions to identify what the NRC concluded were separate comments within each submission.

Accordingly, a single comment submission may have several individual comments within it. The NRC gave each comment submission an individual identifier and each individual comment within a submission to provide a unique identifier (e.g., NFS-1 or GE-5). The individual comment annotations have been listed parenthetically at the end of each comment using this unique identifier.

5 Table 1 - Comment Submissions on Enhanced Weapons, Firearms Background Checks, and Security Event Notifications Rule and Supporting Regulatory Guidance Documents Comment Submission Number1 Commenter Name Affiliation Abbreviation Contains Comments On2 Identical Comment Submission5 Date ADAMS Accession No.

Rule3 Guidance4 1

Anonymous Private Citizen ANON Proposed 04-03-11 ML110950656 2

Ryan M. Spahr Private Citizen RMS Proposed 04-17-11 ML11109A002 3

Craig J.

Renitsky Private Citizen CR Proposed 04-18-11 ML11110A001 4

Mark Elliott Nuclear Fuel Services NFS Proposed 05-04-11 ML11130A041 5

Robert E.

Andrews Congressman-U.S. House of Representatives RA Proposed 05-05-11 ML11130A112 6

Brian Yip Private Citizen BY Proposed 07-14-11 ML11200A092 7

Barry Cole Babcock & Wilcox Nuclear Operating Group B&W Proposed DG-5019, Rev. 1 Weapons Safety Assessment 07-25-11 ML11208B451 8

Patricia L.

Campbell GE Hitachi Nuclear Energy GE Proposed DG-5019, Rev. 1 76FR6085 07-29-11 07-29-11 ML11213A210 ML11214A217 9

Roberta J.

Gray Federal Bureau of Investigation FBI Proposed 07-29-11 ML11216A026 10 S. Hardin Private Citizen SH1 Proposed 08-02-11 ML11216A027 11 R.M. Krich Tennessee Valley Authority TVA Proposed 08-02-11 ML11217A106 12 David R. Kline Nuclear Energy Institute NEI1 Proposed DG-5019, Rev. 1 DG-5020, Rev. 0 Weapons Safety Assessment 76FR6085 76FR6086 76FR6087 08-02-11 08-02-11 08-02-11 08-02-11 ML11229A109 ML11242A127 ML11242A126 ML11242A128 13 Anonymous Palo Verde Nuclear Power Plant PV DG-5019, Rev. 1 08-02-11 ML11216A139 14 Jerry W. Moore Vogtle Nuclear Power Plant JM DG-5020, Rev 0 08-04-11 ML11220A087 15 Anthony Dimitriadis NRC Staff AD DG-5019, Rev. 1 08-05-11 ML11221A139

6 Table 1 - Comment Submissions on Enhanced Weapons, Firearms Background Checks, and Security Event Notifications Rule and Supporting Regulatory Guidance Documents (continued)

Comment Submission Number1 Commenter Name Affiliation Abbreviation Contains Comments On2 Identical Comment Submission5 Date ADAMS Accession No.

Rule3 Guidance4 16 Michael DeAngelo Private Citizen MD 2013 Supplemental Proposed 01-25-13 ML13031A142 17 David R. Kline Nuclear Energy Institute NEI2 2015 Supplemental Proposed 12-07-15 ML15341A278 18 S. Hardin Private Citizen SH2 2015 Supplemental Proposed 12-07-15 ML15348A372 Notes:

1.

The comment submission number corresponds to the order in which the NRC received and docketed each comment submission.

2.

Some comment submissions only contained comments on the proposed rule or the supplemental proposed rule. Some comment submissions only contained comments on the draft supporting regulatory guidance documents. Other comment submissions contained comments on both the proposed rule(s) and draft supporting regulatory guidance documents in a single submission.

3.

Comments submitted on the 2011 proposed rule and 2013 and 2015 supplemental proposed rules are dispositioned in Response to Public Comments: Enhanced Weapons, Firearms Background Checks, and Security Event Notifications Rule, (ML16264A004).

4.

Comments submitted on DG-5019, Revision 1; DG-5020, Revision 0; and the Weapons Safety Assessment are dispositioned in this document. No comments were submitted on DG-5020, Revision 1.

5.

Two commenters submitted identical comments in response to the separate Federal Register notices for the proposed rule and draft regulatory guidance.

7 Comment Grouping In reviewing the public comments and developing responses, the NRC staff has grouped the comments and their associated responses to reflect the four final guidance documents and a group for general comments on these supporting guidance documents, for a total of five groups:

Groups A through E.

Comment Group A contains general comments and issues that are now moot.

Comment Group B contains specific comments affecting RG 5.62, Revision 2.

Comment Group C contains specific comments affecting RG 5.86, Revision 0.

Comment Group D contains specific comments affecting RG 5.87, Revision 0.

Comment Group E contains specific comments affecting NUREG-2264, Revision 0.

In general, the NRC typically tries to address each individual comment by itself. However, if there are similar or related comments, the NRC has grouped these comments together and provided a single response that addresses the common issues raised by these comments.

Where the NRC staff has grouped comments, the individual comment annotations have been listed at the end of a comment. Additionally, as an aid to the reader in referencing a specific comment and response, the NRC has specified an identifier for each comment in each group.

For example, Comment A-1 is the first comment in Group A and Comment B-3 is the third comment in Group B.

RESPONSES TO SPECIFIC COMMENTS A.

Group A - General Comments Comment A-1: Several commenters identified issues with the examples in DG 5019 that involve cyber security event notifications. (PV-19, PV-20, NEI1-A2-81, NEI1-A2-87, NEI1-A2-99, NEI1-A2-119, NEI1-A4-1 through A4-55)

NRC Response: As described above, cyber security event notification requirements were bifurcated from the final enhanced weapons rules provisions on physical security event notifications. Consequently, the NRCs guidance on cyber security event notifications is now located in RG 5.83. These comments were addressed in the NRCs issuance of RG 5.83. As noted above on page 3 of this document, the staffs response to these comments are included in the final cyber security event notifications rule Federal Register notice (80 FR 67264; November 2, 2015) beginning on page 67270.

B.

Group B - Regulatory Guide 5.62 Comment B-1: One commenter, referencing the language in DG-5019, sec. C.2.5.2.x, y, and z, recommended clarification of 4-hour facility notifications related to the notification or unanticipated response of local, State, or Federal law enforcement agencies to the licensees facility. The commenter interpreted these events as being optional reportable events as long as the licensee does not implement its contingency response plan or protective strategy.

(B&W-25)

8 NRC Response: The NRC disagrees with the comment. The NRC has revised the final rule text in 10 CFR 73.1200(e)(3)(i) to require licensees to make a 4-hour notification to the NRC of events involving a law enforcement response to the facility that could reasonably be expected to result in public or media inquiries and that does not otherwise require a notification under other paragraphs of 10 CFR 73.1200." This notification requirement is intended to permit the NRC to promptly respond to public or media inquiries from such LLEA responses to a licensees facility. A licensee may exercise judgement on what could reasonably be expected to result in a public or media inquiry. However, events that the licensee determines will likely result in such an inquiry are not optional and must be reported to the NRC, even if they do not result in the licensees implementation of its contingency response plans.

The NRC has relocated the language in DG-5019, sec. C.2.5.2 in Staff Regulatory Guidance position 9.1 in the final RG 5.62. Although the specific language in sec. C.2.5.2.x, y, and z has been eliminated as a result of this relocation, the NRC has addressed this comment to make clear that the reporting of the types of events raised in the comment is not optional.

Comment B-2: A commenter, referencing language in DG-5019, sec. C.2.5.2.gg, recommended eliminating notifications for events regarding the destruction of, or tampering with, plant equipment (e.g., water coolers, office equipment, maintenance tools) that does not affect plant operations. The commenter, referencing language in DG-5019, sec. C.2.6.2.g, also recommended eliminating notifications for events regarding the destruction of, or tampering with, equipment that does not affect security (e.g., water coolers, office equipment, maintenance tools). The commenter indicated such events could be dealt with in-house by Human Resources personnel to reduce unnecessary licensee burden with no value added. (B&W-26, B&W-27)

NRC Response: The NRC agrees with the comments. The NRC has relocated the language in DG-5019, sec. C.2.5.2.gg and C.2.6.2.g, regarding tampering events affecting plant operations to Staff Regulatory Guidance positions 8.1 and events affecting plant equipment, but not plant operations, to Staff Regulatory Guidance position 10.1 in the final RG 5.62. Accordingly, the NRC has revised the language in Staff Regulatory Guidance positions 8.1 and 10.1 to limit such notification requirements to events involving safety-related SSCs at reactors or items relied upon for safety at Category I SSNM facilities. This guidance is consistent with the revised final rule text in 10 CFR 73.1200(c)(1)(i)(C) and (D) requiring a 1-hr notification of significant tampering events regarding reactor controls or structures, systems, and components (SSCs)

(e.g., events that interrupt the normal operation of a reactor) or results in an accidental criticality at a Category I SSNM facility).

Comment B-3: A commenter, referencing language in DG-5019, secs. C.2.5.2.bb through hh, recommended that the examples regarding the unauthorized use of or tampering with components or controls, including the security system, that do not interrupt the normal operation of the plant but could prevent the implementation of the licensees protective strategy for protecting any target set be removed from the final RG. (NEI1-A2-98)

NRC Response: The NRC agrees with the comment. The NRC has not included the examples in DG-5019, secs. C.2.5.2.bb through hh, in the final RG 5.62. Consistent with the revised final rule text in 10 CFR 73.1200(e)(1)(vi), the NRC requires a 4-hour notification for unauthorized operation, manipulation, or tampering with a nuclear reactor or a Category I SSNM facilitys controls or SSCs that could prevent the implementation of the licensees protective strategy for

9 protecting any target set. Accordingly, the NRC has revised the language in Staff Regulatory Guidance position 9.1 to limit such notification requirements to events involving security-related SSCs at reactors or security related systems at Category I SSNM facilities that could prevent the licensees implementation of its protective strategy for protecting any target set.

Comment B-4: One commenter, referencing language in DG-5019, sec. C.5.3.k, recommended revising logable events regarding discovery of a lost or uncontrolled small quantity of live ammunition within a PA, VA, MAA, or CAA to more than 10 rounds, since a security officer may lose a round of ammunition during normal physical exertion activities or drills. A second commenter referencing language in DG-5019, sec. C.6.1.c, indicated that ammunition is not contraband. This same commenter also noted that ammunition is not required to be logged as a prohibited item. This commenter recommended revising the example of events that are not reportable under proposed 10 CFR 73.71 to include discovery of weapons/ammunition found during entrance searches if the licensee concludes there is no malevolent intent. (B&W-28, NEI1-A2-120)

NRC Response: The NRC agrees in part, and disagrees in part, with the comments. The NRC agrees that the term ammunition (whether authorized within the facility or unauthorized) is not included within the definition of the term contraband as defined in the revised 10 CFR 73.2.

The licensees physical security plan will identify the types of ammunition that are authorized at the facility. The NRC does not consider ammunition, in and of itself, to be an explosive unless the propellant is separated in bulk from the bullets. Consequently, the discovery of a small quantity of live authorized or unauthorized ammunition inside a PA, VA, MAA, or CAA is not considered contraband and is not a reportable event under 10 CFR 73.1200. However, the discovery of such uncontrolled ammunition is a recordable physical security event or condition adverse to security under 10 CFR 73.1210(d)(1) for authorized ammunition or under 10 CFR 73.1210(d)(2) for unauthorized ammunition. Additionally, the NRC has specified in 10 CFR 73.1210(d)(2)(ii), for unauthorized ammunition, that a small quantity of live ammunition means five rounds or fewer of ammunition. However, under 10 CFR 73.1210(d)(1), the NRC has not explicitly specified a meaning for the identical phrase a small quantity of live ammunition for authorized ammunition. Consequently, the NRC recommends as a good practice that a licensee apply the same standard of five rounds or fewer to both authorized and unauthorized ammunition when evaluating whether an event is subject to recording under 10 CFR 73.1210(d). The NRC has relocated the language in DG-5019, sec. C.5.3.k, regarding authorized ammunition events to Staff Regulatory Guidance position 18.1, example (1), in the final RG 5.62. The NRC has revised Staff Regulatory Guidance position 18.1, example (1), to clarify that a small quantity of authorized live ammunition is five rounds or fewer.

The language in DG-5019, sec. C.6.1.c, that the commenter wanted revised has not been included in the final RG 5.62. The NRC has determined that the referenced language in sec. C.6.1.c did not provide useful guidance on the rule text. Separately, the NRC notes that as discussed in the NRCs response to Comment K-1 in the NRCs Response to Public Comments on the Proposed Rule (ML16264A004), the NRC has concluded that a determination of whether malevolent intent was present is not considered appropriate for use by a licensee as a screening criterion in determining whether a physical security event is reportable. Therefore, the NRC has also concluded that malevolent intent is not appropriate as a screening criterion for recordable security events.

10 Accordingly, the NRC has revised Staff Regulatory Guidance position 2 in the final RG 5.62 to clarify that a licensee may not use malevolent intent as a screening criterion in evaluating whether an event is reportable under 10 CFR 73.1200 or recordable under 10 CFR 73.1210.

Finally, the NRC further notes that the attempted introduction of a weapon into a PA, VA, or MAA is a reportable event under 10 CFR 73.1200(e)(1) rather than a recordable event under 10 CFR 73.1210(c)(3).

Comment B-5: One commenter, referencing language in DG-5019, Glossary, for the term Discovery (time of), recommended that discovery means after the initial event has been observed, appropriate internal notifications made, and the licensee has made a determination that the event meets reporting requirements. Another commenter, referencing language in DG-5019, sec. C, paragraph 1, indicated that for access authorization issues, industry guidance under NEI 03-01, Rev. 3, sec. 6.1.b.4, (endorsed by the NRC under RG 5.66) directs licensees to evaluate the reason (i.e., intent) behind inconsistences in submitted background-check/access-authorization information. This evaluation may require some amount of time to complete after the discovery of a potential issue. Therefore, the commenter recommended that access authorization reportable issues be excluded from the time of discovery standard.

(B&W-29, NEI1-A3-1)

NRC Response: The NRC agrees in part, and disagrees in part, with the comments. The NRC disagrees with the first comment that the time of discovery should begin when the licensee has determined that an observed event meets reporting requirements. In the revised 10 CFR 73.2 of the final rule, the NRC has added the term Time of Discovery to mean the time at which a cognizant individual observes, identifies, or is notified of a security-significant event or condition. Consequently, this language for physical security events does not provide licensees the ability to undertake a determination of reportability that exceeds the timeliness requirement of the applicable regulation. Accordingly, the NRC has revised the Glossary and replace the term Discovery (time of) with the term time of discovery in the final RG 5.62 to reference the new definition under 10 CFR 73.2. Additionally, the NRC has added Staff Regulatory Guidance position 1 in the final RG 5.62 to provide additional clarification on time of discovery.

The NRC agrees with the second commenter that licensees may evaluate the reason (i.e., the potential intent) behind inconsistences in submitted background-check/access-authorization information in assessing reportability or recordability of such inconsistencies. Such a review may take longer than the timeliness requirement. The NRC agrees this approach is consistent with the agencys endorsement of NEI 03-01, Rev. 3, sec. 6.1.b.4, by RG 5.66. Accordingly, the NRC has added a clarification in Staff Regulatory Guidance position 18.2, example (1), in the final RG 5.62 regarding the time of discovery for background-check/access-authorization issues.

Comment B-6: One commenter, referencing language in DG-5019, Glossary, recommended that the term contraband be defined in the glossary of the final RG. (GE-4)

NRC Response: The NRC agrees with the comment. The NRC in the final rule modified 10 CFR 73.2 to include a definition for contraband. Consequently, the NRC has revised the Glossary in the final RG 5.62 to add language consistent with the definition of contraband in 10 CFR 73.2. Additionally, the NRC has revised the language in Staff Regulatory Guidance position 6 to provide additional clarification on contraband.

11 Comment B-7: One commenter, referencing language in DG-5019, noted that the value of quoting the text of the regulation within the RG is not clear and that including such text appears to be redundant. The commenter suggested an alternative of placing the rule text in an appendix to the RG. (GE-8)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees that in most cases quoting the text of a regulation within the RG is redundant and unnecessary. However, the NRC has determined that quoting regulatory language in some cases is essential to explaining a regulations requirements.

The NRC does not agree with the commenters suggestion to place rule text in an appendix to the RG. Licensees and other stakeholders have direct access to the final regulations and therefore do not need to have the rule text repeated in an appendix. As an aid to the reader, the language in the RG typically references the relevant regulatory citation being discussed.

Accordingly, the NRC has revised the final RG 5.62 to remove unnecessary quotation of the applicable final rule regulatory language.

Comment B-8: One commenter, referencing language in DG-5019, sec. C.2.3.1, C.2.3.2.x, C.2.4.1, C.2.5.2.d, C.5.1.c, and C.5.3.t, recommended that physical security event notification guidance should exclude events involving the loss of control of classified information. (GE-9, GE-10, GE-11, GE-13).

NRC Response: The NRC agrees with the comment. The NRC has not included the language and examples in sec. C.2.3.1, C.2.3.2.x, C.2.4.1, C.2.5.2.d, C.5.1.c, and C.5.3.t, referring to the loss of control of classified information in the final RG 5.62. The NRC has revised sec. B topic Security Events Associated with or Involving Classified Information in the final RG 5.62 to specify that events involving the loss or compromise of classified information are addressed under 10 CFR 95.57. Additionally, the NRC has provided direction in Staff Regulatory Guidance position 19 for an event that involves both a physical security event notification requirement and the loss or compromise of classified information notification requirement.

Comment B-9: One commenter, referencing language in DG-5019, sec. C.5.1, Appendix G, Paragraph IV.d, recommended deletion of the phrase classified information containing with respect to the protection of Safeguards Information. (GE-12)

NRC Response: Section C.5.1 of DG-5019 containing the language that the commenter wanted deleted has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides, since in most cases quoting the text of a regulation within the RG is redundant and unnecessary. Although the NRC agrees with the comment, since sec. C.5.1 of DG-5019 has been excluded from the final RG 5.62 to conform to the NRCs current style guide, the NRC has taken no action in response to this comment.

Comment B-10: One commenter, referencing language in DG 5019, sec. C.2.3.2.h, recommended deleting the exception for 1-hour reportable events involving the actual or attempted introduction of contraband into a licensees Protected Area (PA), if the licensee concludes the event was not willful or deliberate. The commenter also objected to a licensee delaying reporting of the event until the licensee determines if malevolent intent was present.

12 Instead, the commenter recommended that a licensee should report all such contraband events within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Finally, the commenter stated that the attempted introduction of contraband into any reactor site should be reported within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. (AD-1, AD-2, AD-3, AD-4)

NRC Response: The NRC agrees in part, and disagrees in part, with the comments. The NRC has determined that any attempted or actual introduction of contraband into a protected area (PA), vital area (VA), or material access area (MAA) is reportable. The NRC has determined that the attempted or actual introduction of contraband into a licensees facility, for whatever reason, is a significant security concern that requires a 4-hour event notification under the final rule provisions in 10 CFR 73.1200(e)(1)(iii) and (iv). Consequently, consistent with the final rule language, the NRC disagrees that the attempted introduction of contraband into any reactor site should be reported within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. For the reasons set forth in the NRCs response to Comment Number 72 below, the NRC agrees that delaying an event notification while a licensee determines whether the attempted or actual introduction of contraband reflects malevolent intent is not appropriate.

The discussion on 4-hour notification requirements is set forth in Staff Regulatory Guidance position 9.1 in the final RG 5.62, The NRC has not included the language in sec. C.2.3.2.h of DG-5019 in the final RG because the regulatory language in 10 CFR 73.1200(e)(1)(iii) and (iv) is clear on its face.

Comment B-11: One commenter, referencing language in DG-5019, sec. A, paragraph 2, recommended removing the term classified from this paragraph because it could be confused with events regarding the declaration of emergencies that are described in 10 CFR 50.47.

(PV-1)

NRC Response: Section A, paragraph 2, of DG-5019 containing the language that the commenter wanted removed has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because Section A, paragraph 2, of DG-5019 has not been included in the final RG 5.62, the NRC has taken no action in response to this comment.

Comment B-12: One commenter, referencing language in DG-5019, sec. A, paragraph 3, recommended that the phrase "indicative of imminent or actual hostile actions" should be changed to read "indicative of security conditions or hostile actions." (PV-2)

NRC Response: Section A, paragraph 3, of DG-5019 containing the language that the commenter wanted revised has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because Section A, paragraph 3, of DG-5019 has been excluded from the final RG 5.62, the NRC has taken no action in response to this comment.

Comment B-13: One commenter, referencing language in DG-5019, sec. B, paragraph 3, recommended that the word such be removed from the phrase upon notification of such a hostile action. The commenter, referencing language in DG-5019, sec. B, paragraph 6, also recommended that the phrase these examples are interpreted as the only events to be reported be replaced with these examples are understood as being the only events to be reported... Another commenter, referencing language in DG-5019, sec. 2.3, paragraph 2,

13 recommended rewording the general description of unauthorized entry events from unauthorized entry of personnel into a PA, VA, MAA, or CAA; malevolent attempted entry of personnel into a PA, VA, MAA, or CAA to unauthorized entry of personnel (i.e., intruder or a person under escort (e.g., visitor) who intentionally gets separated from their escort) into a PA, VA, MAA, or CCA. (PV-3, PV-4, NEI1-A3-2)

NRC Response: Section B, paragraphs 3 and 6 of DG-5019 containing the language that the first commenter wanted revised has not been included in the final RG 5.62. Section C.2.3, paragraph 2, of DG-5019 containing the language that the second commenter wanted revised has not been included in the final RG 5.62. These exclusions were made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because these paragraphs have not been included in the final RG 5.62, the NRC has taken no action in response to these comments.

Comment B-14: One commenter, referencing language in DG-5019, sec. C, paragraphs 1 and 2, recommended that the phrase suspicious events be replace with suspicious activities.

(PV-5, PV-6, PV-7, PV-8)

NRC Response: Section C, paragraphs 1 and 2, of DG-5019 containing the language that the commenter wanted revised has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because these paragraphs have not been included in the final RG 5.62, the NRC has taken no action in response to these comments.

Comment B-15: One commenter, referencing language in DG-5019, sec. C.2, paragraph 1, recommended that the phrase are considered significant and in the text telephonic notifications are considered significant and require clear, person-to-person communication be removed. The commenter, referencing language in DG-5019, sec. C.2.1, paragraph 5, and sec.

C.2.2, paragraph 4, also recommended that the discussion of hostile actions be removed as it is inconsistent with NRC and industry accepted wording for this term. A second commenter, referencing language in DG-5019, sec. C.2.1, paragraphs 3 and 5, noted a conflict between these paragraphs. Paragraph 3 states that DG-5019 does not apply to aircraft attacks.

Paragraph 5 states that hostile actions include attacks by air. The commenter recommended deleting air from paragraph 5. (PV-9, PV13, PV-14, NEI1-A2-45)

NRC Response: Section C.2 of DG-5019 containing the language that the commenters wanted deleted has not been included in the final RG 5.62. Section C.2.1, paragraphs 3 and 5 and sec.

C.2.2, paragraph 4 of DG-5019 that the commenter wanted revised or removed have not been included in the final RG 5.62. These exclusions were made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because these paragraphs have not been included in the final RG 5.62, the NRC has taken no action in response to these comments.

Comment B-16: One commenter, referencing language in DG-5019, sec. C.2, paragraph 6, recommended that the phrase "declare an emergency" be replaced with "report an emergency declaration." The commenter indicated that emergency declarations are governed under 10 CFR 50.47 and so the use of the phrase "declare an emergency" in this context does not comport with the 10 CFR 50.72 reference in the next part of the sentence. (PV-10)

14 NRC Response: Section C.2 of DG-5019 containing the language that the commenter wanted deleted has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. However, the NRC notes that it has incorporated the commenters suggested language of report an emergency declaration into the revised discussion topic in Section B, Reporting of an Emergency Declaration, in the final RG 5.62.

Comment B-17: One commenter, referencing language in DG-5019, sec. C.2.1, paragraph 3, recommended deleting the last sentence regarding reporting aircraft threats and attacks in accordance with RG 1.214. The commenter indicated that stating here that aircraft threats and attacks are not included may lead to confusion on the part of the licensee as these are also a part of classifiable security events under 10 CFR 50.47 via NEI 99-01, Rev 5. (PV-11)

NRC Response: The NRC agrees with the comment. The NRC has provided guidance on addressing aircraft threats and attacks in RG 1.214. That guidance does not need to be duplicated in the final RG 5.62. Accordingly, the NRC has not included the language in DG-5019, sec. C.2.1, paragraph 3, or guidance on aircraft threats and attacks in the final RG 5.62.

Comment B-18: One commenter, referencing language in DG-5019, sec. C.2.1, paragraph 4, recommended that the phrase or security condition be added to the end of the sentence.

(PV-12)

NRC Response: The NRC agrees with the comment. The NRC has determined that the recommended language will add clarity. The language from DG-5019, sec. C.2.1, paragraph 4, is discussed in Staff Requirements Guidance position 7.1, example (1), in the final RG 5.62 and includes the phrase or security condition.

Comment B-19: One commenter, referencing language in DG-5019, sec. C.2.3.2.r.7, recommended deleting the text or emergency from within the phrase the licensees or certificate holders security or emergency plans regarding the loss of all offsite communications capabilities. The commenter was concerned that this example could cause confusion with emergency classifications made under 10 CFR 50.47 and NEI 99-01, NESP-007, and NUREG-0654 EALs. (PV-15)

NRC Response: The NRC agrees with the comment. The NRC has not included in the final rule a requirement to provide a physical security event notification for the loss of all offsite communications capability. The language from DG-5019, sec. C.2.3.2.r.7, discussing the loss of off-site communications capabilities has been relocated to Staff Requirements Guidance position 8.1, example (6), in the final RG 5.62. Example (6) does not include language regarding a licensees emergency plan.

Comment B-20: One commenter, referencing language in DG-5019, sec. C.3.7, questioned what was meant by training as a communicator regarding staffing a continuous communications channel. A second commenter, referencing the same language stated that the phrase and received training as a communicator was undefined and unnecessary. This commenter recommended deleting the phrase. (PV-17, NEI1-A2-104)

15 NRC Response: The NRC agrees with the comments. The phrase training as a communicator" is unclear. The final rule, under 10 CFR 73.1200(o)(5)(iii), (6)(ii), (7)(ii), and (8)(ii), states that if the NRC requests that a licensee or its movement control center (MCC) establish a continuous communications channel, the licensee or its MCC must staff the position with a knowledgeable individual. The language from DG-5019, sec. C.3.7, discussing the need for a continuous communications channel has been relocated to Staff Requirements Guidance position 16.1 in the final RG 5.62. Consistent with the regulatory language in 10 CFR 73.1200(o), Staff Regulatory Guidance position 16.1 does not include language regarding training as a communicator.

Comment B-21: One commenter, referencing language in DG-5019, sec C.3.10, paragraph 2, recommended that the phrase security events may be retracted at any time be replaced with the phrase security event notifications may be retracted at any time. (PV-18)

NRC Response: The NRC agrees with the comment. A security event notification is being retracted, not the underlying security event itself. The language from DG-5019, sec. C.3.10, paragraph 2, has been relocated to Staff Requirements Guidance position 14 in the final RG 5.62. Consequently, the NRC has revised Staff Regulatory Guidance position 14 to use the phrase a licensee may retract a physical security event notification.

Comment B-22: One commenter, referencing language in DG-5019, Glossary, recommended that the definition for the term hostile action be revised and definitions for the terms hostile force and imminent be added to the Glossary. The commenter also suggested adding to the Glossary definitions for the terms Security Condition, Security Event, and Security Incident.

The commenter asserts that these changes would increase consistency between the final RG 5.62 and NEI guidance. The commenter further suggested adding NEI-03-12 and NEI 99-01, Rev. 5, in the References section of DG-5019. A second commenter stated that all definitions in the Glossary should be synchronized with other applicable code requirements, RGs, and documents, such as NEI guidance documents. (PV-21, PV-22, PV-23, PV-25, PV-26, PV-27, PV-28, NEI1-A2-126)

NRC Response: The NRC agrees in part, and disagrees in part, with the comments. The NRC agrees that the definition of the term hostile action should be revised, and new terms added to the final RG 5.62, Glossary. The NRC has revised the definition of the term hostile action" in the Glossary to incorporate some, but not all, of the suggested language in the NEI definition.

Some of the language in the NEI definition of hostile action was not included because it is reactor specific, and the final RG 5.62 is intended for use by other types of NRC licensed facilities and licensed activities. The NRC has also revised the Glossary to include definitions for the following terms: hostile force, imminent, security condition, security event, and security incident. These definitions in the Glossary are consistent with the corresponding definitions in NRC regulatory requirements and regulatory guides. Generally, the definitions in the Glossary are consistent with, but may not follow the exact wording of, definitions in various NEI guidance documents.

The NRC disagrees with the comment to add NEI guidance documents to the References Section in the final RG 5.62. While these NEI documents may be used by a licensee at their own discretion, the NRC has chosen to only include documents in the References Section that were issued by the NRC or other government agencies. Therefore, the NRC has not included in

16 the Reference Section documents that were issued by the Nuclear Energy Institute because these documents tend to be specific to one type of NRC licensee.

Comment B-23: One commenter, referencing language in DG-5019 Glossary, recommended deleting the punctuation (a period) at the end of the term Loss of SNM. (PV-24)

NRC Response: The NRC has not used the phrase loss of SNM in either the final rule or the final RG 5.62. Accordingly, because this phrase is not used in the final rule or RG 5.62, the NRC has taken no action on this comment.

Comment B-24: One commenter, referencing language in DG-5019, sec. C.2.3.2.w, recommended that incomplete or inaccurate preauthorization screening issues resulting in 1-hour unauthorized access events be replaced with the following alternate language:

incomplete or inaccurate pre-access screening events involving licensee program failure that did result in unescorted access authorization (UAA) or unescorted access (UA), had the screening been complete and accurate the individual would have been denied UAA/UA (involving either the authorization or the granting of unescorted access). A failure to perform an appropriate evaluation or background investigation so that information relevant to the access determination was not obtained or considered and as a result a person, who would have been denied access by the licensee if the required investigation or evaluation had been performed.

The commenter, referencing language in DG-5019, sec. C.5.3.g, also noted that this example is unclear and requires further clarification. (NEI1-A2-110, NEI1-A3-3)

NRC Response: The NRC disagrees with the comments. Consistent with the language in Staff Regulatory Guidance positions 13 and 18.2 in the final RG 5.62, individuals improperly granted unescorted access or unescorted access authorization (UA/UAA) are not considered unauthorized persons under 10 CFR 73.1200(e)(1)(i) and (ii). Therefore, there is no requirement to make an event notification to the NRC when such individuals attempt to or actually gain access to a PA, VA, MAA, or CAA. The NRC recommends, consistent with the language in Staff Regulatory Guidance positions 13 and 18.2, example (1), that such events be recorded under 10 CFR 73.1210(f) as a decrease in security program effectiveness.

Accordingly, the NRC has not adopted the first commenters proposed language.

The NRC agrees with the second comment that sec. C.5.3.g of DG-5019 is unclear. The NRC has determined that the language in Staff Regulatory Guidance positions 13 and 18.2, example (1), clarifies what licensees should do when discovery that an individual has been improperly granted unescorted access authorization. Accordingly, the NRC has not adopted the second commenters proposed language.

Comment B-25: One commenter, referencing language in DG-5019, sec. C.5.3.g, questioned if a licensee that has incorrectly authorized an individual unescorted access based upon false information provided by the individual should treat this situation as a 1-hour event notification or a recordable event as indicated under DG-5019, sec. C.5.3? The commenter also recommended that the NRC develop language in the final RG involving deliberate falsification of

17 background information by an individual seeking unescorted access or unescorted access authorization. (NEI1-A3-5, NEI1-A3-6, NEI1-A3-7)

NRC Response: The commenter referenced language in DG-5019, sec. C.5.1.g. There was no sec. C.5.1.g in DG-5019. The language the commenter quoted was from DG-5019, sec. C.5.3.g.

The NRC has based its response on the language from DG-5019, sec. C.5.3.g. As discussed in the NRCs response to Comment B-24 above, a licensee that has improperly granted an individual UA/UAA is not required to make an event notification to the NRC if the individual accesses the licensees PA, VA, MAA, or CAA. The NRC recommends, consistent with the language in Staff Regulatory Guidance positions 13 and 18.2, example (1), that such events be recorded under 10 CFR 73.1210(f). The NRC disagrees with the suggestion to include language on deliberate falsification, since making such a determination may be highly subjective.

Comment B-26: One commenter, referencing language in DG-5019, sec. C.5, paragraph 4, indicated that the language in the paragraph requires recording events that could have allowed unauthorized or undetected access to the owner-controlled area (OCA) in the safeguards event log. The commenter notes that there is no requirement to restrict access or account for unauthorized or undetected OCA access. The commenter recommends removing the phrase OCA from the paragraph. (NEI1-A3-4)

NRC Response: The NRC agrees with the comment. There is no provision in the final rule requiring the recording of undetected or unauthorized access events in a licensees OCA. The language from DG-5019, sec. C.5, paragraph 4, regarding OCA events is discussed in Staff Requirements Guidance position 18.2 in the final RG 5.62. Consequently, the NRC has revised Staff Regulatory Guidance position 18.2, example (10), to clarify that such OCA access events are not recordable under 10 CFR 73.1210.

Comment B-27: One commenter, referencing language in DG-5019, sec. C.5.3.bb, recommended that the example regarding recording of events involving the termination of certain personnel be deleted because there is no basis for this event recording in the regulation.

(NEI1-A3-8)

NRC Response: The NRC agrees with the comment. There is no provision in the final rule requiring the recording of events involving the termination of licensee personnel. Guidance on the recording of security events and conditions is set forth in Staff Requirements Guidance position 18 in the final RG 5.62. The language in DG-5019, sec. C.5.3.bb, has not been included in the final RG 5.62.

Comment B-28: One commenter, referencing language in DG-5019, Glossary, recommended that the definitions for the terms authorized unescorted access and authorized be added to the Glossary in the final RG 5.62. The commenter also recommended replacing the existing definition of unauthorized person in the Glossary with the term unauthorized to reference persons, vehicles, and items, since all three are addressed in the regulation. The commenter suggested wording for these terms. (NEI1-A3-9, NEI1-A3-10, NEI1-A3-11)

NRC Response: The NRC disagrees with these comments. The NRC has not added the terms authorized and authorized unescorted access to the final RG 5.62 Glossary. The NRC has not included the term authorized in the Glossary because its meaning is generally understood.

18 The NRC has not included the term authorized unescorted access in the Glossary because that term does not appear in the NRCs regulations or RG 5.62. The term unescorted access is used in the NRCs regulations and is understood to mean a type of access that is authorized by a licensee or a licensees reviewing official. Therefore, the NRC has determined that adding these terms to the Glossary is not necessary. The NRC has revised the final RG 5.62, Glossary, to remove the term unauthorized person. Staff Regulatory Guidance position 13 in RG 5.62 clarifies what is meant by the term unauthorized persons.

Comment B-29: One commenter, referencing language in DG-5019, Glossary, recommended that the definition for an uncontrolled authorized weapon, included in the proposed rule under Appendix G to 10 CFR Part 73, paragraph I(d)(2), was more appropriate in the Glossary of the final RG 5.62. (NEI1-A2-14)

NRC Response: The NRC agrees with the comment. In the final rule under 10 CFR 73.1200(e)(1)(v)(B), the NRC has specified the meaning of the term uncontrolled authorized weapon. Therefore, the NRC has added a definition for the term uncontrolled authorized weapon to the Glossary in the final RG 5.62.

Comment B-30: One commenter, referencing language in DG-5019, sec. C.2.1, paragraph 3, recommended moving the first sentence regarding the priority of requesting LLEA assistance in the third paragraph to the beginning of this section. (NEI1-A2-44)

NRC Response: The NRC agrees with the comment. The NRC has provided guidance on the precedence of reporting 15-minute event notifications in Staff Requirements Guidance position 7.3 in the final RG 5.62. The NRC has relocated the guidance in DG-5019, sec. C.2.1, paragraph 3, on the priority of requesting LLEA assistance for 15-minute event notifications to Staff Regulatory Guidance position 7.3, paragraph 1, of the final RG to make clear that a licensees request for immediate LLEA assistance, initiation of a contingency response, or notification of State officials required under the licensees Emergency Response Plan should take precedence over its physical security event notification to the NRC.

Comment B-31: One commenter, referencing language in DG-5019, sec. C.2.1.2.d, stated that this section established a threshold for 15-minute event notifications involving weapons. The commenter further noted that DG-5019, sec. C.2.1.2.c, did not meet the threshold for requiring a 15-minute event notification. Therefore, the commenter recommended that sec. C.2.1.2.c should be deleted. (NEI1-A2-46)

NRC Response: The NRC disagrees with the comment. First, it is not clear to the NRC what threshold the commenter is referring to. The language in DG-5019, secs. C.2.1.2.c and C.2.1.2.d, did not establish a threshold for the firing of a weapon that would require a 15-minute event notification. They were only examples of two types of events that would require such a notification. The NRC considers both types of events to be a significant security concern requiring notification to the NRC. The NRC has relocated DG-5019, secs. C.2.1.2.c and C.2.1.2.d, to Staff Regulatory Guidance position 7.1, examples (5) and (6), respectively, in the final RG 5.62. Additionally, the NRC has revised example (5) to replace the term controlled area" with more specific refences to a licensees PA, VA, MAA, or CAA to enhance clarity.

19 Additionally, the NRC has also revised Staff Regulatory Guidance position 7.2, examples (6) and (7), in the final RG 5.62 to provide similar guidance to apply with respect to the firing of weapons at transport vehicles or escort vehicles.

Comment B-32: One commenter, referencing language in DG-5019, sec. C.2.1.2.j, regarding an event notification based upon a licensees initiation of security response in accordance with its safeguards contingency plan or protective strategy recommended deleting this example. The commenter stated that this example was redundant to other examples in section C.2.1.2.a, d, e, and i. (NEI1-A2-47)

NRC Response: The NRC disagrees with the comment. In the final rule under 10 CFR 73.1200(a)(1) the NRC has required a 15-minute event notification for a licensees initiation of a security response in accordance with its safeguards contingency plan or protective strategy, based on an imminent or actual hostile action against a licensees facility. The NRC considers an event requiring a licensee to initiate its safeguards contingency plan or protective strategy to be a significant security concern. The examples in DG-5019, sec. C.2.1.2.a, d, e, and i, do not address a licensees initiation of a security response in accordance with its safeguards contingency plan or protective strategy. The NRC has relocated DG-5019, sec.

C.2.1.2.j, to Staff Regulatory Guidance position 7.1 in the final RG 5.62. Staff Regulatory Guidance position 7.1, example (1), states that an event notification may be based upon a licensee initiating a security response as a result of an imminent or actual hostile action, act of sabotage, or security condition against the licensees facility or material.

Comment B-33: One commenter, referencing language in DG-5019, sec. C.2.1.2.b, recommended that clarifying language be added to exclude explosive charges used for legitimate purposes (e.g., steam generator tube sheet explosive welding). (NEI1-A2-48)

NRC Response: The NRC agrees with the comment. The NRC has relocated DG-5019, sec.

C.2.1.2.b, to Staff Regulatory Guidance position 7.1, example (3), in the final RG 5.62.

Additionally, the NRC has revised example (3) to include clarifying language excepting detonations of authorized explosive materials and devices used for legitimate purposes from this event notification requirement.

Comment B-34: One commenter, referencing language in DG-5019, sec. C.2.1.2.h, recommended revising language that was unclear by replacing believed theft of SSNM or SNF with significant information causing a licensee reason to conclude that a theft of SSNM or SNF has occurred. (NEI1-A2-49)

NRC Response: The language in DG-5019, sec. C.2.1.2.h, that the commenter wanted revised has not been included in the final RG 5.62. The NRC has determined that the referenced language in sec. C.2.1.2.h did not provide useful guidance on the rule text. The final rule under 10 CFR 73.1200(c)(1)(i)(A) specifies a 1-hour facility notification for an event in which there is reason to believe that a person has committed or caused, or attempted to commit or cause, or has made a threat to commit or cause (A) The theft or diversion of a Category I, II, or III quantity of SSNM or a Category II or III quantity of special nuclear material (SNM). Accordingly, because the language the commenter wanted revised has not been included in the final RG, the NRC has taken no action in response to this comment.

20 Comment B-35: One commenter, referencing language in DG-5019, sec. C.2.1.2.k, indicated that it was unclear if the text after the example referred to vehicle barrier system (VBS) events.

The commenter recommended reformatting the second paragraph to indicate it applied to k.

(NEI1-A2-50)

NRC Response: The NRC agrees with the comment. The NRC intended the proposed language in the paragraph referenced by the comment to support the preceding example k. The NRC has relocated the paragraph after DG-5019, sec. C.2.1.2.k, to Staff Regulatory Guidance position 12 and relocated DG-5019, sec. C.2.1.2.k, to Staff Regulatory Guidance position 7.1, example (11), both in the final RG 5.62. The NRC has simplified and revised Staff Regulatory Guidance position 12 to clarify what is meant by a required VBS.

Comment B-36: One commenter, referencing language in DG-5019, sec. C.2.2, paragraph 3, recommended relocating the first sentence of paragraph 3 to the beginning of section C.2.2.

(NEI1-A2-51)

NRC Response: The NRC agrees with the comment. This comment is identical to Comment B-30 above. Accordingly, the NRC reiterates its response to Comment B-30.

Comment B-37: One commenter, referencing language in DG-5019, sec. C.2.2, paragraph 4, recommended that the definition of hostile action should be revised to be consistent with the definition of this term in industry guidance documents NEI 03-12 and NEI 99-01; and reviewed against the NRCs language in RG 5.76. The commenter also recommended using the definition for imminent contained in NEI 03-12. (NEI1-A2-52)

NRC Response: This comment is identical to a portion of the comment raised in Comment B-22 above. Accordingly, the NRC reiterates its response to Comment B-22.

Comment B-38: One commenter, referencing language in DG-5019, sec. C.2.2, paragraph 4, stated that the phrase to deliver destructive force is overly broad and subject to interpretation and recommended that it be deleted. (NEI1-A2-53)

NRC Response: DG-5019, sec. C.2.2, paragraph 4, containing the language that the commenter wanted removed has not been included in the final RG 5.62. This information was excluded from the final RG in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because DG-5019, sec. C.2.2, paragraph 4, has not been included in the final RG, the NRC has taken no action in response to this comment.

Comment B-39: One commenter, referencing language in DG-5019, sec. C.2.2.2.d, recommended that sec. C.2.2.2.d be deleted as it does not appear to rise to the level of a 15-minute notification. (NEI1-A2-54)

NRC Response: The NRC disagrees with the comment. The NRC has determined that the successful, forcible penetration of a transport vehicle by unauthorized personnel is of sufficient security significance to justify a 15-minute notification. Such a penetration could result in an adversary gaining control of the transport vehicle and the material it is transporting. The NRC has relocated the guidance in C.2.2.2.d in DG-5019 to Staff Regulatory Guidance position 7.2, example (8) of the final RG 5.62. Additionally, the NRC has provided similar guidance in

21 example (9) regarding the forcible penetration of the package being transported. These examples clarify that the successful forcible penetration of either a transport vehicle or a transport package are subject to a 15-minute event notification requirement.

Comment B-40: One commenter, referencing language in DG-5019, sec. C.2.3, paragraph 7, recommended that the paragraph be eliminated. (NEI1-A2-57)

NRC Response: DG-5019, sec. C.2.3, paragraph 7, containing the language that the commenter wanted removed has not been included in the final RG 5.62. This information was excluded from the final RG in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because DG-5019, sec. C.2.3, paragraph 7, has not been included in the final RG, the NRC has taken no action in response to this comment.

Comment B-41: One commenter, referencing language in DG-5019, sec. C.2.3.2, suggested that a number of the provided examples, encompassing multiple scenarios, do not provide additional clarity. The commenter recommended providing specific examples with greater granularity. The commenter, referencing language in DG-5019, sec. C.2.3.2.f, also suggested that the example of dismounted individuals and the licensees VBS is unclear and appears duplicative of the example in C.2.3.2.h. The commenter recommended clarifying the intent of this example. (NEI1-A2-58, NEI1-A2-62)

NRC Response: The NRC agrees with the comment. The language from DG-5019, sec.

C.2.3.2, is discussed in Staff Regulatory Guidance position 8.1 of the final RG 5.62. The NRC has revised the guidance to remove duplicative and confusing examples. Additionally, the NRC agrees that the guidance on dismounted individuals was unclear and has removed that guidance from Staff Regulatory Guidance position 8.1.

Comment B-42: One commenter, referencing language in DG-5019, sec. C.2.3.2.d, suggested that this example is redundant to the example in sec. C.2.3.2.c. The commenter, referencing language in DG-5019, sec. C.2.3.2.l, m, and n, also suggested that these examples are redundant to the example in DG-5019, sec. C.2.3.2.k. The commenter, referencing language in DG-5019, sec. C.2.3.2.r.3, also suggested this example is redundant to the example in DG-5019, sec. C.2.3.2.z. The commenter recommended deleting these redundant examples.

(NEI1-A2-61, NEI1-A2-69, NEI1-A2-74)

NRC Response: The NRC agrees with the comments that duplicative examples are unnecessary. The NRC provides guidance on 1-hour event notifications in Staff Regulatory Guidance position 8.1 in the final RG 5.62. The NRC has revised Staff Regulatory Guidance position 8.1 in final RG 5.62 to exclude duplicative examples.

Comment B-43: One commenter, referencing language in DG-5019, sec. C.2.3.2.h, suggested revising the example to clarify that the 1-hour event notification applies to an actual or attempted introduction of contraband into a PA, VA, MAA, or CAA. The commenter also recommended deleting the parenthetical phrase "(e.g., unauthorized weapons, explosives, or incendiaries).

The commenter further suggested sec. C.2.3.2.i was redundant to sec. C.2.3.2.h and recommended deleting sec. C.2.3.2.i. (NEI1-A2-63, NEI1-A2-64, NEI1-A2-65)

22 NRC Response: The NRC agrees in part, and disagrees in part, with the comments. The NRC does not agree that the actual or attempted introduction of contraband in a PA, VA, or MAA requires a 1-hour event notification. In the final rule under 10 CFR 73.1200(e)(1)(iii) and (iv), the NRC has required a 4-hour event notification for the actual or attempted introduction of contraband into a PA, VA, or MAA. Such contraband events do not apply to a CAA. Therefore, the NRC has not provided guidance on the attempted or actual introduction of contraband into a CAA in RG 5.62.

The NRC agrees with the commenter that duplicative language should not be included in NRC RGs. The NRC has determined that the final rule language on the attempted or actual introduction of contraband into a PA, VA, or MAA is clear on its face and does not need to be discussed in the final RG 5.62, Staff Regulatory Guidance position 9.1, addressing 4-hour event notifications. Accordingly, the language in DG-5019, secs. C.2.3.2.h and C.2.3.2.i has not been included in the final RG.

Comment B-44: One commenter, referencing language in DG-5019, sec. C.2.3.2.k.1, states that the term uncompensated is defined in the Glossary. The commenter further stated that the language in sec. C.2.3.2.k.1 does not provide additional clarity beyond the language in the Glossary and recommended it should be deleted. (NEI1-A2-67)

NRC Response: The NRC agrees with the comment. The language in sec. C.2.3.2.k.1 is redundant to the definition of the term uncompensated in the Glossary and does not add additional clarity. Accordingly, the language in DG-5019, sec. C.2.3.2.k, has not been included in the final RG 5.62.

Comment B-45: One commenter, referencing language in DG-5019, sec. C.2.3.2.q, suggested that the language relating to undetected or unauthorized access within 1-hour is not clear and appears to combine a 1-hour notification with a 24-hour recordable event. The commenter recommended deletion or rewording of this example. (NEI1-A2-68)

NRC Response: The language in DG-5019, sec. C.2.3.2.q, that the commenter wanted revised has not been included in the final RG 5.62. The NRC determined that the referenced language in sec. C.2.3.2.q did not provide useful guidance on the rule text. Accordingly, because this language has not been included in the final RG, the NRC has taken no action in response to this comment.

Comment B-46: One commenter, referencing language in DG-5019, sec. C.2.3.2.r, stated the proposed regulation referred to the interruption of normal operation of the reactor, not of the facility. The commenter recommended revising the language in C.2.3.2.r to refer to a licensees reactor or a certificate holders facility. (NEI1-A2-70)

NRC Response: The comment is correct that the regulatory language in 10 CFR 73.1200(c)(1)(i)(C) only applies to the interruption of normal operation of a power reactor. The language in DG-5019, sec. C.2.3.2.r, that the commenter wanted revised has not been included in the final RG 5.62. The NRC determined that the referenced language in sec. C.2.3.2.r did not provide useful guidance on the rule text. Accordingly, because this language has not been included in the final RG, the NRC has taken no action in response to this comment.

23 Comment B-47: One commenter, referencing language in DG-5019, sec. C.2.3.2.r.1, suggested that requiring a notification for interruption of normal plant operation due to willful human error could be unrelated to actual tampering. The commenter suggested removing the phrase willful human error. The commenter also recommended removing the phrase reasonable mechanical failure. Finally, the commenter suggested that the language associated with events that do not result in the interruption of normal operations of a reactor discussed in the second half of the sec. C.2.3.2.r.1 paragraph should be either a 4-hour or an 8-hour event notification. (NEI1-A2-71)

NRC Response: The NRC agrees that the language in DG-5019, sec. C.2.3.2.r.1, combines tampering events that impact normal operation of a reactor with tampering events that do not impact the normal operation of a reactor. The final rule language under 10 CFR 73.1200(c)(1)(i)(C) refers to the interruption of the normal operation of a power reactor due to unauthorized operation, manipulation, or tampering with the reactors controls or its structures, systems, and components (SSCs). The NRC has relocated the discussion of tampering events requiring a 1-hour notification in DG-5019, sec. C.2.3.2.r.1, to Staff Regulatory Guidance position 8.1 in the final RG 5.62. The phrases willful human error and reasonable mechanical failure have not been included in RG 5.62 because the NRC has determined that these phrases do not provide useful guidance on the final rule text.

The NRC agrees that the language in DG-5019, sec. C.2.3.2.r.1, discussing tampering events that do not impact the normal operation of a reactor should not be subject to a 1-hour event notification requirement. The final rule language under 10 CFR 73.1200(g)(1)(ii) requires that such events be reported within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The NRC has relocated the discussion of these types of tampering events to Staff Regulatory Guidance position 10.1 in the final RG 5.62.

Comment B-48: One commenter, referencing language in DG-5019, secs. C.2.3.2.r.3, C.2.3.2.r.4, C.2.3.2.r.5, and C.2.3.2.r.6, suggested that language on a labor strike, mass demonstration, or bomb/extortion threat, did not fit under the criteria of DG-5019, sec C.2.3.2.r.

The commenter suggested relocating these examples to another section. The commenter, referencing language in DG-5019, sec. C.2.3.2.r.3, also suggested that this example is redundant to DG-5019, sec. C.2.3.2.z; and that this example is not consistent with the criteria established in Appendix G to 10 CFR Part 73.

The commenter, referencing language in DG-5019, sec. C.2.3.2.r.4, further suggested that specifying a mass demonstration as five or more individuals was arbitrary and too low. The commenter also recommended that without an apparent threat or hostile action this example should be an 8-hour notification. The commenter, referencing language in DG-5019, sec.

C.2.3.2.r.5, further suggested edits to the language regarding nearness and prior authorization.

The commenter, referencing language in DG-5019, sec. C.2.3.2.r.6, also suggested that this language was inconsistent with the proposed rules Statement of Considerations discussion on whether a licensee could determine the credibility of an event. The commenter, referencing language in DG-5019, sec. C.2.3.2.r.6, suggested alternate language regarding the reportability of bomb or extortion threats. (NEI1-A2-73, NEI1-A2-74, NEI1-A2-75, NEI1-A2-76, NEI1-A2-77)

24 NRC Response: The NRC agrees with the comments. The specific language in DG-5019, secs. C.2.3.2.r.3, C.2.3.2.r.4, C.2.3.2.r.5, and C.2.3.2.r.6 has not been included in the final RG 5.62. The NRC has determined that the language in these examples did not provide useful guidance on the final rule. However, the NRC has provided guidance on determining the credibility of a security event or threat in Staff Regulatory Guidance positions 2 and 7.1, example (2), in the final RG 5.62. Additionally, the NRC has provided guidance on handling bomb threats in Staff Regulatory Guidance positions 8.1, example (2), 8.2, example (1), and 16.3, example (1). Finally, the NRC has provided guidance on strikes and work stoppages in Staff Regulatory Guidance position 10.1, example (4) in the final RG 5.62.

Comment B-49: One commenter, referencing language in DG-5019, sec. C.2.3.2.s, stated that language requiring reporting incidents involving battery against a plant employee could be interpreted to require the reporting of offsite incidents of domestic violence that have no nexus to a facilitys security. The commenter suggested that unless there was a specific identified threat to the facility, a battery involving a plant employee should be reported within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The commenter also suggested that it was unclear how licensees would have sufficient information to determine if an individual is a member of a terrorist organization. This could require a licensee to make a 1-hour report solely on inuendo. The commenter also noted that the phrase involving individuals was ambiguous and recommended it be replaced with the phrase committed by individuals. (NEI1-A2-78)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees that the language relating to a battery against a plant employee could result in the reporting of an event that has no direct nexus to nuclear security. An event that has no nexus to nuclear security need not be reported. Accordingly, the NRC has not included language relating to a battery against a plant employee in the final RG 5.62.

The NRC does not agree with the suggestion that information related to a licensees employee or contractor potentially being a member of a terrorist organizations should be reported within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Under the final rules provisions in 10 CFR 73.1200(e)(2) and 73.1200(f)(2), a licensee that has information indicating that one of its employees or contractors is potentially involved in terrorist activities, other criminal activities, or is affiliated with a terrorist organization, should report that information to appropriate law enforcement authorities and then notify the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> instead of the comments proposed 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Such information may be derived from the licensees insider mitigation program or from other sources. The NRC does not expect a licensee to conduct an investigation to substantiate the reported information. The NRC has included guidance from DG-5019, sec. C.2.3.2.s, regarding notifications of terrorist activities and other criminal acts to law enforcement authorities in Staff Regulatory Guidance position 9.1, example (3), and position 9.2, example (1), in the final RG 5.62.

Comment B-50: One commenter, referencing language in DG-5019, secs. C.2.3.2.t and u, stated that the phrase access to controlled areas is too broad. The commenter recommended replacing this text with access to a PA, VA, MAA, or CAA. (NEI1-A2-79, NEI1-A2-80)

NRC Response: The NRC agrees with the comment that the phrase controlled area" is overly broad. The NRC has relocated the language from DG-5019, secs. C.2.3.2.t and C.2.3.2.u to Staff Regulatory Guidance position 10.1 in the final RG 5.62. The language in Staff Regulatory

25 Guidance position 10.1 uses the commenters suggested language access into a PA, VA, MAA, or CAA.

Comment B-51: One commenter, referencing language in DG-5019, sec. C.2.6.2.g, recommended deleting this language because it has no relation to plant security. (NEI1-A2-102)

NRC Response: The NRC agrees with the comment. The NRC determined that the referenced language in DG-5019, sec. C.2.6.2.g, did not provide useful guidance beyond the final rule text.

Accordingly, the NRC has not included the language from sec. C.2.6.2.g in the final RG 5.62.

Comment B-52: One commenter, referencing language in DG-5019, sec. C.2.5.2.jj, recommended that the requirement to report the loss or theft of an enhanced weapon from outside of a PA or CAA be eliminated as this event would not affect the licensees protective strategy. The commenter, referencing language in DG-5019, secs. C.2.7.2.a, C.2.7.2.b, C.2.7.2.c, and C.2.7.2.e, separately recommended that these events should be reported within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. (NEI1-A2-98, NEI1-A2-103)

NRC Response: The NRC disagrees with the comments. The NRC does not agree with the commenters suggestion that the loss or theft of an enhanced weapon it possesses occurring outside of the PA should not have to be reported. A licensee would be required to report the loss or theft of an enhanced weapon, wherever it occurs, to the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) in accordance with ATFs regulations. The Commission has determined that the risk associated with the loss or theft of an enhanced weapon raises a significant security concern. Therefore, in the final rule under 10 CFR 73.1200(m)(1)(ii), the NRC requires a licensee possessing enhanced weapons to report the theft or loss of any enhanced weapon possessed by the licensee within 1-hour of the licensees required initial notification to the ATF of the missing enhanced weapons. The rule language does not make any distinction between the loss or theft of an enhanced weapon within or outside a licensees PA.

Additionally, consistent with the final rule language, the NRC does not agree with the commenters suggestion that the loss or theft of an enhanced weapon should be reported within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The NRC has discussed the language in DG-5019, secs. C.2.5.2.jj, C.2.7.2.a, C.2.7.2.b, C.2.7.2.c, and C.2.7.2.e, regarding lost or stolen enhanced weapons in Staff Regulatory Guidance position 11.2 in the final RG 5.62.

Comment B-53: One commenter, referencing language in DG-5019, sec. C.4, paragraph 1, stated that there does not seem to be any value in the written follow-up reports required by the proposed rule provisions in 10 CFR 73.71(e), (f), and (g). The commenter recommended deleting the proposed rule language in 10 CFR 73.71(e), (f), and (g) and the corresponding guidance in DG-5019, sec. C.4, paragraph 1, because these written follow-up reports created an unnecessary administrative burden on licensees. (NEI1-A2-105)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees with deleting the proposed rule language in 10 CFR 73.71(g) from the final rule.

Accordingly, in the final rule under 10 CFR 73.1205(a)(2)(ii), the NRC has exempted licensees from submitting a written follow-up report subsequent to a licensees event notification made under 10 CFR 73.1200(m), regarding the loss or theft of enhanced weapons. Additionally, the

26 NRC has not included any guidance related to these types of written follow-up reports in the final RG 5.62.

The NRC disagrees with the commenters recommendation to remove guidance on the submission of written follow-up reports subsequent to any 4-hour and 8-hour security event notifications. In the final rule under 10 CFR 73.1205(a)(1), the NRC has required licensees to submit written follow-up reports subsequent to event notifications made under 10 CFR 73.1200(a) through (h) (i.e., for 15-minute, 1-hour, 4-hour, and 8-hour security event notifications for facilities and transportation activities). The NRC has discussed the language from DG-5019, sec. C.4, paragraph 1, in Staff Regulatory Guidance position 17 in the final RG 5.62. Staff Regulatory Guidance position 17 provides guidance on written follow-up reports required subsequent to a licensees event notification made under the requirements of 10 CFR 73.1200(a) through (h), including the 4-hour and 8-hour notifications required by the proposed rule language in 10 CFR 73.71(e) and (f).

Comment B-54: One commenter, referencing language in DG-5019, secs. C.4.1 and C.4.4, noted that the NRC has not specified the content of the abstract required when submitting reports using NRC Form 366. The commenter recommended clarifying the requirement or stating that the contents are at the licensees discretion. (NEI1-A2-106)

NRC Response: The NRC agrees with the comment. The NRC revised the final rule language under 10 CFR 73.1205(c)(1) to specify the contents of the abstract for an NRC Form 366. The rule specifies specific elements that must be included in an abstract but does not limit the abstract to only those elements identified in the rule. The NRC has also discussed the contents of an abstract in the revised discussion topic in Section B, Written Follow-up Reports, in the final RG 5.62.

Comment B-55: One commenter, referencing language in DG-5019, sec. C.5, paragraph 2, noted that the last three words of the first sentence of the paragraph, whichever is greater, are not consistent with the proposed rule language. The commenter recommended deleting these words. (NEI1-A2-107)

NRC Response: The NRC agrees with the comment. The NRC has revised the final rule language under 10 CFR 73.1210(b)(2) to require licensees recording physical security events to retain these records for a period up to 3 years after the last entry is recorded, or until their license is terminated, whichever is later. The NRC has discussed the requirement to retain the records relating to the recording of physical security events in the revised discussion topic in Section B, Records Retention and Destruction, in the final RG 5.62.

Comment B-56: One commenter, referencing DG-5019, sec. C.5.1, indicated this proposed rule text on explosives or incendiaries beyond a vehicle barrier should be conditioned to apply only for explosive or incendiaries that are not intended for valid and authorized activities at the facility. (NEI1-A2-108)

NRC Response: DG-5019, sec. C.5.1, containing the language that the commenter wanted revised has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. DG-5019, sec. C.5.1, has not been included in the final RG 5.87. Accordingly, the NRC has taken no action in

27 response to this comment. The NRC notes that explosives, explosive devices, and incendiary devices intended for authorized and legitimate purposes at a facility are not reportable as contraband. The NRC has provided guidance on this issue in Staff Regulatory Guidance position 6 in the final RG 5.62.

Comment B-57: One commenter, referencing language in DG-5019, secs. C.5.3.c, d, and h, indicated that these examples of short duration failures of search equipment, separation from escorts, or failure to adequately compensate for an access vulnerability would be logable events regardless of the timeframe. The commenter stated that exceeding the timeframes provided in the examples would not change the reporting requirement. The commenter recommended deleting the timeframe examples. (NEI1-A2-109)

NRC Response: The NRC agrees with the comment. These types of events would be recordable irrespective of their duration. The NRC has not included the language in DG-5019, secs. C.5.3.c, d, and h, in the final RG 5.62.

Comment B-58: One commenter, referencing language in DG-5019, sec. C.5.3.p, indicated that this example is confusing. The commenter noted that the status of the protected area perimeters intrusion detection system does not change the reporting requirement for loss of lighting. The commenter recommended rewording sentence as failure or degradation of lighting below security-plan requirements; and deleting all other wording. (NEI1-A2-111)

NRC Response: The NRC agrees with the comment. The NRC has discussed language in DG-5019, sec. C.5.3.p, in Staff Regulatory Guidance position 18.2 of the final RG 5.62. The NRC has revised Staff Regulatory Guidance position 18.2, example (6), to include recording of an event involving the failure or degradation of a PA, VA, or MAA lighting or illumination system to below the NRC-approved security-plan requirements.

Comment B-59: One commenter, referencing language in DG-5019, sec. C. 5.3.q, indicated that this example is confusing. The commenter noted that the loss of full capability of an alarm station is logable if properly compensated. The commenter recommended rewording to loss of capability of one alarm station (for facilities with two alarm stations); and deleting all other wording. (NEI1-A2-112)

NRC Response: The NRC agrees with the comment. The NRC has relocated language from DG-5019, sec. C.5.3.q, to Staff Regulatory Guidance position 18.2 of the final RG 5.62. Staff Regulatory Guidance position 18.2, example (7), states that the full loss of one alarm station (for a facility with two alarm stations) is a recordable event.

Comment B-60: One commenter, referencing language in DG-5019, sec. C.5.3.r, indicated that the loss of control or protection of Safeguard Information is logable in all cases where there is no evidence of theft or compromise. The logging of such an event is not dependent on how long the loss of control exists before the Safeguards Information is recovered. The commenter recommended removing the timeframe language in sec. C.5.3.r. The commenter also indicated that the examples in DG-5019, secs. C.5.3.s. and C.5.3.u are identical and recommended removing the duplication. (NEI1-A2-113, NEI1-A2-114)

28 NRC Response: The NRC agrees with the comments. The NRC has relocated language from DG-5019, sec. C.5.3.r, to Staff Regulatory Guidance position 18.2, example (5), of the final RG 5.62. The language in example (5) states that an event involving the loss of control or protection over Safeguards Information where there does not appear to be evidence of theft or compromise without reference to the timeframe for the recovery of the Safeguards Information.

The NRC agrees that the examples in DG-5019, secs. C.5.3.s and C.5.3.u, are duplicative.

Additionally, the NRC has determined that these examples do not provide useful guidance on the protection of Safeguards Information. Accordingly, the NRC has not included the language in DG-5019, secs. C.5.3.s. and C.5.3.u, in the final RG 5.62.

Comment B-61: One commenter, referencing language in DG-5019, sec. C.5.3.v, indicated that the loss of control of an authorized security weapon should be a logable event regardless of when the weapon is recovered. The commenter recommended deleting the reference to loss within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of retrieval. (NEI1-A2-115)

NRC Response: The NRC agrees with the comment. The NRC has relocated the language from DG-5019, sec. C.5.3.v, to Staff Regulatory Guidance position 18.2, example (8), in the final RG 5.62. The NRC has revised the language in example (8) to remove the reference to retrieval within 1-hour of the discovery of the loss of the weapon.

Comment B-62: One commenter, referencing language in DG-5019, sec. C.5.3.y, disagreed with treating unsubstantiated bomb or extortion threats as a recordable event and indicated that this event should be an 8-hour reporting requirement. (NEI1-A2-116)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees that a licensees receipt of an unsubstantiated bomb threat should not be treated as a recordable event. The NRC disagrees that an unsubstantiated bomb threat should be treated as an 8-hour reportable event. In the final rule under 10 CFR 73.1200(c)(1)(i)(B), the NRC has required a licensee to make a 1-hour event notification where there is reason to believe a personhas made a threat to commit or causesignificant physical damage to a reactor or other facility. This would include receiving a bomb threat because such a threat, if implemented, could potentially cause significant physical damage to a reactor. RG 5.62 discusses unsubstantiated bomb threats in Staff Regulatory Guidance position 8.1, example (2).

Example (2) states that a licensee receiving an unsubstantiated bomb threat must make a 1-hour notification to the NRC. Additionally, although not related to this comment, the NRC notes that it has not included the language in DG-5019, sec. C.5.3.y, related to unsubstantiated extortion threats in example (2) since that type of event is not included within 10 CFR 73.1200(c)(1)(i).

Comment B-63: One commenter, referencing language in DG-5019, sec. C.5.3.aa, questioned whether this example referred to missed checks that are not regulatory checks but required by security procedure need to be logged? The commenter recommended changing security requirements to security plan requirements. (NEI1-A2-117)

NRC Response: The NRC agrees with the comment. The NRC agrees that unanticipated instances of missed security patrols or security checks should be recorded under 10 CFR 73.1210(f). The NRC has discussed the language in DG-5019, sec. C.5.3.aa, in Staff Regulatory Guidance position 18.2, example (4), in the final RG 5.62. The NRC has revised

29 example (4) to refer to unplanned missed security patrols or checks which resulted in a failure to meet the licensees NRC approved physical security plans. This includes patrols or checks that were not accomplished within the require timeframes specified in these physical security plans.

Comment B-64: One commenter, referencing language in DG-5019, sec. C.5.3.cc, indicated that highlighted text should be changed. The commenter also indicated that consideration needs to be made regarding sites that allow the admittance of firearms/contraband onto site property. The commenter recommended replacing the highlighted text or with and. (NEI1-A2-118)

NRC Response: Regarding the first portion of the comment, the comment did not highlight any of the three conjunctions or within sec. C.5.3.cc. Therefore, the NRC was unable to determine which of the three conjunctions or should be replaced with and. Consequently, the NRC has taken no further action in response to this portion of the comment.

Regarding the second portion of the comment, the NRC has not included any separate notification requirements regarding firearms and contraband possessed outside of a licensees protected area in the final rule language. Accordingly, the NRC has determined that language in DG-5019, sec. C.5.3.cc, does not provide useful guidance on implementing the final rule and has not included this language in the final RG 5.62.

Comment B-65: One commenter, referencing language in DG-5019, sec. C.6.2, indicated that the examples in this section are not logable events. The commenter recommended that sec. C.6.2 should be moved to DG-5019, sec. C.5.4. The commenter, referencing language in DG-5019, sec. C.6.2.c and e, also indicated that if the event is not reportable, then the 1-hour determination does not apply as these examples are of events that are not recordable events.

The commenter recommended deleting the 1-hour determination criteria. (NEI1-A2-122, NEI1-A2-123)

NRC Response: The language in DG-5019, sec. C.6.2, containing the language that the commenter wanted revised and relocated has not been included in the final RG 5.62. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. The NRC has taken no action in response to this comment.

Comment B-66: One commenter, referencing language in DG-5019, sec. D, paragraph 1, recommended that NUREG-1304 should be withdrawn until a Revision 1 to NUREG-1304 is issued to avoid conflict with Revision 2 to RG 5.62. (NEI1-A2-125)

NRC Response: The NRC agrees with the comment. The NRC has specified in the Statement of Considerations accompanying the final rule that NUREG-1304 will be temporarily withdrawn following the publication of the final rule. The NRC has discussed the language in DG-5019, sec. D, paragraph 1, regarding NUREG-1304 in the final RG 5.62, sec. A, Related Guidance, footnote 2 (on page 3). In footnote 2, the NRC has indicated that it has temporarily withdrawn NUREG-1304, Revision 0, until NUREG-1304, Revision 1, is developed and issued.

30 Comment B-67: One commenter, referencing language in DG-5019, Glossary, indicated that the first sentence in the definition for contraband is not consistent with the discussion in DG-5019, sec. C.2.3, paragraph 3. The commenter recommended deleting the sentence. (NEI1-A2-128)

NRC Response: The NRC agrees with the comment. The NRC has revised the final rule language under 10 CFR 73.2 to include a definition for the term contraband. Accordingly, the NRC has revised the term contraband in the Glossary of the final RG 5.62 to conform to the final rule language.

Comment B-68: One commenter, referencing language in DG-5019, secs. C.2.3.1.j, C.2.4.1.j, and C.2.3.2.x, recommended that the final RG not comingle reporting requirements for physical security event notifications with the separate classified information reporting requirements under 10 CFR 95.57. The commenter recommended that secs. C.2.3.1.j, C.2.4.1.j, and C.2.3.2.x be deleted. (GE-9)

NRC Response: The NRC agrees with the comment. The language DG-5019, secs. C.2.3.1.j, C.2.4.1.j, and C.2.3.2.x, have not been included in the final RG 5.62. The NRC agrees that events associated with the deliberate disclosure, theft, loss, compromise, or possible compromise of classified documents, information, or material are handled in accordance with the requirements in 10 CFR 95.57. Additionally, in RG 5.62, Staff Regulatory Guidance position 19, the NRC has clarified that an event may potentially require both a physical security event notification under 10 CFR 73.1200 and a classified information event notification under 10 CFR 95.57. Consequently, the NRC has recommended as a good practice that licensees should follow the elimination of duplication provisions in 10 CFR 73.1200(s) if they are making a single communication of two such event notifications.

Comment B-69: One commenter, referencing language in DG-5019, Glossary, indicated that the definition for covered weapons included items not considered as weapons, such as ammunition and feeding devices. The commenter recommended alternate wording excluding the terms ammunition and feeding devices. (NEI1-A2-127)

NRC Response: The NRC has not used the term covered weapon in the final RG 5.62; and therefore, has not included this term in the Glossary of the final RG. Accordingly, the NRC has taken no action on the final RG 5.62 in response to this comment. The NRC notes that the final rule language under 10 CFR 73.2 has added a new definition for covered weapon that includes the terms ammunition for any such weapons, or large capacity ammunition feeding device.

Comment B-70: One commenter, referencing language in DG-5019, sec. C.2.5.2.aa, recommended that the proposed sub bullet language on licensees are not required to notify the NRC of law enforcement personnel onsite for nonresponse duties, training exercises, familiarization and coordination activities, other scheduled activities, or the sharing of information be removed and instead be a stand-alone item. (NEI1-A2-97)

NRC Response: The NRC agrees with this comment. The presence of law enforcement personnel at a licensees facility for non-response activities would not reasonably be expected to result in public or media inquiries; and therefore, does not require a notification to the NRC.

Accordingly, the NRC has included language in Staff Regulatory Guidance position 9.1 of the final RG 5.62 indicating that the presence of law enforcement personnel at a licensees facility

31 for purposes such as: training, security exercises, site familiarization, or coordination activities, does not require an event notification under 10 CFR 73.1200(e)(3).

Comment B-71: One commenter, referencing the language in DG-5019, secs. C.2.5.2.x, C.2.5.2.y, and C.2.5.2.z, recommended clarifying that the 4-hour facility notifications related to the response of local, State, or Federal law enforcement agencies to the licensees facility are optional reportable events as long as the licensee does not implement its contingency response plan or protective strategy. (B&W-25)

NRC Response: The NRC does not agree with the comment. In the final rule under 10 CFR 73.1200(e)(3)(i), the NRC requires that a licensee notify the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of events involving a law enforcement response to the facility that could reasonably be expected to result in public or media inquiries. The NRC expects a licensee to exercise judgement to determine whether such a response of law enforcement personnel to the licensees facility could reasonably be expected to result in public or media inquiries. The NRC has determined that language in DG-5019, secs. C.2.5.2.x, C.2.5.2.y, and C.2.5.2.z, does not provide useful guidance on implementing the final rule and has not included this language in the final RG 5.62.

Comment B-72: One commenter, referencing language in DG-5019, sec. C.2.3, paragraph 2, suggested that the language should be revised to clarify the need for a deliberate and malevolent intent evaluation prior to making a notification for a 1-hour reportable event. The commenter, referencing language in DG-5019, secs. C.2.3.2.a and c, also suggested revising these examples to clarify that such events should only be reported when malicious or malevolent intent is present. The commenter, referencing language in DG-5019, secs.

C.2.6.1.1, C.2.6.1.2, C.2.6.1.3, and App G, Paragraph IIII, also suggested that this language should be modified to require reporting only if licensee has reason to believe the event was caused by malicious intent. The commenter, referencing language in DG-5019, secs. C.2.6.2.a through f, further recommended that these events should only be reported when malicious or malevolent intent is present. The commenter, referencing language in DG-5019, sec. C.6.1.c, also recommended that the non-reportable example of the discovery of weapons during an entrance search with no malevolent intent be moved to an 8-hour reportable event on unauthorized operation, manipulation or tampering under DG-5019, sec. C.2.6. (NEI1-A2-55, NEI1-A2-59, NEI1-A2-60, NEI1-A2-66, NEI1-A2-100, NEI1-A2-101, NEI1-A2-121)

NRC Response: The NRC disagrees with the comments. The NRC has determined that a licensee is not required to possess the personnel resources and qualifications necessary to assess whether a physical security event was caused by malevolent intent. A determination of malevolent intent should only be made by a qualified government agency such as the NRCs Office of Investigations, the intelligence community, or a law enforcement agency. Therefore, a determination of whether malevolent intent was present is not considered appropriate for use by a licensee as a screening criterion in determining whether a security event is reportable within the specified timeliness requirement. However, a licensee may use a government determination that malevolent intent was not present as a basis for subsequently withdrawing a previous security event notification as invalid. The NRC in the final rule language in 10 CFR 73.1200 has removed the term malevolent intent as a screening criterion for licensees to use in evaluating whether a notification should be made. Accordingly, the NRC has clarified this position in Staff Regulatory Guidance position 2 in the final RG 5.62.

32 Section C.2.6.1 of DG-5019 containing the language that the commenter wanted revised has not been included in the final RG 5.62. This language has not been included in accordance with the NRCs current style guide for the development of regulatory guides.

Comment B-73: One commenter, referencing language in DG-5019, sec. C.2.3.2.r.8, suggested that the loss of a standard weapon did not fit under the criteria of sec. C.2.3.2.r. The commenter suggested relocating this example to another section. The commenter, referencing language in DG-5019, sec. C.2.5.2.ii, also stated that the loss of a standard weapon would not impact a licensees protective strategy and recommended that this language be eliminated. (NEI1-A2-73, NEI1-A2-98)

NRC Response: In the final rule the NRC has not included the term standard weapon; nor any language on the loss of a standard weapon. Accordingly, the NRC has not included the language in DG-5019, secs. C.2.3.2.r.8 and C.2.5.2.ii, in the final RG 5.62. The NRC notes that recording the loss of control of an authorized security weapon is discussed in Staff Regulatory Guidance position 18.2, example (8), in the final RG 5.62.

The NRC notes that other aspects of comment NEI1-A2-98, referencing language in DG-5019, secs. C.2.5.2.bb through hh and sec. C.2.5.2.jj, are addressed in Comments B-3 and B-52 above.

C.

Group C - Regulatory Guide 5.86 Comment C-1: One commenter, referencing language in DG-5020, recommended incorporating additional final rule text into the final RG 5.86 similar to the approach taken by the NRC in DG-5019. (NEI1-A1-2)

NRC Response: The NRC disagrees with the comment. As discussed in Comment B-7 above, the NRCs view is that in most cases quoting the text of a regulation within a RG is redundant and unnecessary. However, the NRC has determined that quoting regulatory language in some cases is essential to explaining a regulations requirements. As an aid to the reader, the NRC has included in the final RG 5.86 cross-references to the applicable regulations under 10 CFR 73.15 and 10 CFR 73.17.

Comment C-2: One commenter, referencing language in DG-5020, sec. C.1.8.1, recommended changing the definition for covered weapons to any enhanced weapon or Standard Weapon as defined in 73.2. (NEI1-A1-10)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC has provided a definition of the term covered weapon in the Glossary of the final RG 5.86. The term covered weapon in the RG conforms with the definition of this term in the final rule under 10 CFR 73.2. However, the NRC disagrees with including the phrase standard weapon within the term covered weapon because the NRC has removed the phrase standard weapon from the final rule language in 10 CFR 73.2.

Comment C-3: One commenter, referencing language in DG-5020, sec. C.2.5, indicated the term certificate security personnel needs to be changed for consistency with other documents.

33 The commenter recommended using the term certificate holder rather than certificate security personnel. (NEI1-A1-11)

NRC Response: The NRC has removed references to certificate holders from the final rule language. The references were removed because there are no longer any 10 CFR Part 76 certificate holders for a gaseous diffusion uranium enrichment facility, and the NRC does not expect to issue any 10 CFR Part 76 certificates of compliance in the future. Accordingly, there is no reference to certificate holders or certificate security personnel in the final RG 5.86.

Consequently, the NRC has taken no further action in response to this comment.

Comment C-4: One commenter, referencing language in DG-5020, sec. C.6.1, recommended clarifying what documents supporting modifications to the security plan must be submitted to the NRC for review and approval as part of a licensees application for combined preemption authority and enhanced weapons authority. (NEI1-A1-12)

NRC Response: The NRC agrees with the comment. The NRC in the final rule under 10 CFR 73.15(f)(1) has specified that a licensee applying for combined preemption authority and enhanced weapons authority must submit to the NRC for prior review and approval a new, revised, or addendum to the licensees current physical security plan, training and qualification plan, and safeguards contingency plan as well as a new weapons safety assessment. The NRC has provided guidance on creating or revising these plans to support an application for combined preemption authority and enhanced weapons authority in Staff Regulatory Guidance positions 3.1 through 3.4 in the final RG 5.86.

Comment C-5: One commenter, referencing language in DG-5020, sec. C.10.1, noted that the term site of the facility is used and defined in this section. The commenter recommended that the terms site of the facility and site boundary be defined within the glossary of RG 5.86.

(NEI1-A1-13)

NRC Response: The NRC disagrees with the comment. The NRC has not included the terms site of the facility or site boundary in the Glossary for the final RG 5.86. The NRC has removed the term site of the facility from the final RG because it has determined that the term is confusing and does not provide licensees with useful guidance. Additionally, the NRC has not included the term site boundary in the Glossary because it has determined that the term is well understood by stakeholders. The NRC has provided guidance applicable to facility site boundaries in Staff Regulatory Guidance position 8.6 in the final RG 5.86.

Comment C-6: One commenter, referencing language in DG-5020, sec. C.15.1, paragraph 11, recommended clarifying what the term break in service means for performing a new firearms background check as applied to absences due to military duty, vacation, sick time, FMLA, short term disability, and long term disability. (NEI1-A1-14)

NRC Response: The NRC agrees with the comment. The NRC has relocated the language in DG-5020, sec. C.15.1, paragraph 11, to Staff Regulatory Guidance position 6.5 of the final RG 5.86. The NRC agrees that the terms vacation, sick time, Family Medical Leave Act (FMLA), short-term disability, and long-term disability should be included in Staff Regulatory Guidance position 6.5 as examples of absences that do not require a break in service firearms background check. Accordingly, the NRC has revised Staff Regulatory Guidance position 6.5 to

34 include vacation time, sick time, FMLA, short-term disability, and long-term disability as examples of absence that do not require a break in service firearms background check.

Additionally, the NRC has also discussed in Staff Regulatory Guidance position 6.5 that the final rule under 10 CFR 73.17(b)(9)(iv) includes an exception to performing a break in service firearms background check, if the absence was due to temporary active duty with the U.S.

military reserves or National Guard.

Comment C-7: One commenter, referencing language in DG-5020, sec. C.8, recommended adding language that Security Training Firearms Instructors must be trained or certified by a State or nationally recognized entity for each enhanced weapon for which the individual will be providing instruction and this is consistent with Reg Guide 5.75, [Training and Qualification of Security Personnel at Nuclear Power Reactor Facilities]. The commenter indicated this would enhance consistency and act as a reminder to those who may not remember the previous guidance on standard weapons as well as the new guide on enhanced weapons. (JM-1)

NRC Response: The NRC agrees with the comment. The NRC agrees that guidance on instructor qualifications regarding training on enhanced weapons is appropriate. The NRC has relocated the language in DG-5020, sec. C.8, to Staff Regulatory Guidance position 5.4 of the final RG 5.86. Accordingly, the NRC has revised Staff Regulatory Guidance position 5.4 to include language that as a good practice "instructors training security personnel on the use and handling of enhanced weapons be trained or certified by a State or nationally recognized entity for the specific type of enhanced weapons for which the individual will be providing instruction.

The NRC also recommended that licensees may wish to refer to RG 5.75, as appropriate, for additional information on firearms instructor qualifications.

D.

Group D - Regulatory Guide 5.87 Comment D-1: One commenter, referencing language in DG-5019, sec. C.2.5.1.a.1.b, indicated that the phrase elicitation of information from facility personnel relating to the security or safe operation of the facility is vague and subject to interpretation. The commenter was concerned that this language could be interpreted to apply to legitimate public inquiries. The commenter recommended rewording the example to refer to non-routine and suspicious elicitation events. The commenter, referencing language in DG-5019, sec. C.2.5.2.h, separately indicated that the wording is overly broad and could apply to routine inquiries about security systems. The commenter recommended modifying the example to state, "non-routine and suspicious elicitation of information from security or other site personnel regarding security systems or vulnerabilities." The commenter, referencing language in DG-5019, sec. C.2.5.2.n, separately indicated that the word unusual adds too much interpretation. The commenter suggests replacing unusual with repeated attempts after requests have been denied by the same individual(s) to obtain (NEI1-A2-82, NEI1-A2-86, NEI1-A2-89)

NRC Response: The NRC agrees that the language in DG-5019, sec. C.2.5.1, is vague and could be interpreted to apply to legitimate public inquiries about the safe and secure operation of a facility. However, the NRC notes that the language the commenter wanted reworded has not been included in the final RG 5.87. This exclusion was made in accordance with the NRCs current style guide for the development of regulatory guides. Accordingly, because DG-5019, sec. C.2.5.1, has not been included in the final RG, the NRC has taken no action in response to this comment.

35 The NRC agrees that the language in DG-5019, secs. C.2.5.2.h and C.2.5.2.n, is overly broad and could be interpreted to apply to routine inquiries about security systems. The NRC has relocated the language in DG-5019, secs. C.2.5.2.h and C.2.5.2.n, to Staff Regulatory Guidance position 5.1, example (8), in the final RG 5.87. Example (8) addresses the commenters concerns but does not adopt the specific wording proposed by the commenter.

Comment D-2: One commenter, referencing language in DG-5019, sec. C.2.5.2.b, indicated that the use of the term owner-controlled property was overly broad and could imply a duty to surveil such areas for suspicious activities. The commenter recommended using the term owner-controlled area. Additionally, the commenter noted that licensees having a site policy prohibiting the taking of photographs at the facility (e.g., use of a cell phone camera in the owner-controlled area) could be required to report this action as a suspicious activity even if that action has no nexus to security. (NEI1-A2-83)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees that the term owner-controlled property is overly broad. The NRC has relocated the language in DG-5019, sec. C.2.5.2.b, to Staff Regulatory Guidance position 5.3.1, example (4),

in the final RG 5.87. The NRC has used the term owner-controlled area in example (4) and elsewhere in RG 5.87.

The NRC does not agree with the commenters concern that licensees would be required to report activities in violation of a site policy prohibiting photography as a suspicious activity.

Consistent with the language in the final rule under 10 CFR 73.1215(c)(2)(iii), licensees are given discretion in determining if an action is innocent or innocuous. For example, a licensee taking into account the totality of the circumstances could determine that a photograph taken in violation of site policy was either innocent or innocuous or constituted a suspicious activity.

Comment D-3: One commenter, referencing language in DG-5019, sec. C.2.5.2.e, indicated that loitering for no apparent purpose in areas where intelligence could be gathered or where preoperational reconnaissance could be performed is already covered by other examples. The commenter recommended deletion. The commenter, referencing language in DG-5019, sec.

C.2.5.2.m, also expressed concern that the language regarding loitering and boating activities included undefined terms. The commenter recommended deleting or attempts to loiter near and add within before restricted areas. (NEI1-A2-84, NEI1-A2-88)

NRC Response: The NRC agrees with these comments. The language in DG-5019, secs.

C.2.5.2.e and C.2.5.2.m, have not been included in the final RG 5.87 because the NRC has determined that these examples are already addressed by the language in Staff Regulatory Guidance position 5.3.1, example (2), in the final RG 5.87. The NRC has provided guidance that individuals entering or loitering in areas immediately adjacent to a licensees facility may be considered suspicious. This may include both land and water areas adjacent to the licensees facility.

Comment D-4: One commenter, referencing language in DG-5019, sec. C.2.5.2.g, indicated that secretive sketching, making maps or taking notes on the owner-controlled area could be applied to activities involving site personnel during normal business and to personal diary activities. The commenter suggested adding language to the example such as would be

36 indicative of preoperational surveillance, reconnaissance, or intelligence gathering activities directed against the facility. (NEI1-A2-85)

NRC Response: The NRC agrees with the comment. The NRC agrees that the recording of information in personal diaries and for normal work purposes should not be considered a suspicious activity. Accordingly, the NRC has included language in Staff Regulatory Guidance position 5.3.2, example (1), in the final RG 5.87 to clarify that information recording activities involving personal diaries and normal work activities should not be considered suspicious activities. The NRC has also included the commenters suggested language in example (1).

Comment D-5: One commenter, referencing language in DG-5019, sec. C.2.5.2.o, indicated that internet site postings that make violent threats could be read to require licensees to make reports for facilities other than their own. The commenter recommends revising the example to refer to threats related to a licensees nuclear facility or licensed activities. (NEI1-A2-90)

NRC Response: The NRC agrees with the comment. The NRC has determined that the language in DG-5019, sec. C.2.5.2.o, is confusing and has not been included in the final RG 5.87. Additionally, the NRC notes that the monitoring the internet for threats to licensed facilities and activities is a function of the U.S. Department of Homeland Security, Cybersecurity

& Infrastructure Security Agency, and the intelligence community.

Comment D-6: One commenter, referencing language in DG-5019, secs. C.2.5.2.p and C.2.5.2.q, indicated that the statements regarding unusual threats or terrorist-related activities that become known to facility security or management and stated threat(s) against the licensees or certificate holders facility or staff are redundant to other language in DG-5019.

The commenter recommended they be deleted. (NEI1-A2-91, NEI1-A2-92)

NRC Response: The NRC agrees with the comments. The NRC views unusual threats or terrorist-related activities related to a licensees facility or staff to not be a suspicious activity but instead should be reported as a physical security event notification under 10 CFR 73.1200 (see RG 5.62 for further guidance on such events). Accordingly, the NRC has not included these examples in the final RG 5.87.

Comment D-7: One commenter, referencing language in DG-5019, sec. C.2.5.2.r, indicated that the language unsubstantiated bomb or extortion threats that are considered to be related to harassmentshould be recorded in the safeguards log until a pattern is discovered is unclear and self-contradictory. The commenter suggested alternate wording. (NEI1-A2-94)

NRC Response: The NRC has determined that a licensee is not required to have the personnel resources with the technical qualifications necessary to assess whether a bomb or extortion threat is substantiated or unsubstantiated. Accordingly, the NRC has not included the language of DG-5019, sec. C.2.5.2.r, in the final RG 5.87. The NRC has taken no further action in response to this comment.

Comment D-8: One commenter, referencing language in DG-5019, sec. C.2.5.2.s, indicated that fires or explosions of a suspicious or unknown origin should be reworded to exclude events reportable under 10 CFR 50.72(a)(1)(i). The commenter also recommended removing the words or unknown. (NEI1-A2-95)

37 NRC Response: The NRC agrees with the comment. Fires or explosions that require the declaration of an emergency class should be reported under the licensees applicable safety event notification regulations, e.g., 10 CFR 50.72, 10 CFR 63.73, 10 CFR 70.74, or 10 CFR 72.75. Moreover, fires or explosions are also potentially indicative of radiological sabotage or tampering events and therefore may require a physical security event notification under 10 CFR 73.1200. The NRC has not included the language in DG-5019, sec. C.2.5.2.s, as a suspicious activity in the final RG 5.87.

Comment D-9: One commenter, referencing language in DG-5019, secs. C.2.5.2.t, indicated that suspicious aircraft activities involving photographing the facility or surrounding area was unachievable. The commenter recommended removing this phrase. (NEI1-A2-96)

NRC Response: The NRC agrees with the comment. The NRC has discussed the language in DG-5019 sec. C.2.5.2.t, regarding unauthorized aerial overflights in Staff Regulatory Guidance position 5.3.1, example (5) in the final RG 5.87. The NRC agrees that that determining the objective of an unauthorized aerial overflight may not be possible; and therefore, has revised and simplified example (5) to refer to unauthorized unmanned aerial systems or circling manned aircraft overflights. Accordingly, the NRC has revised Staff Regulatory Guidance position 5.3.1, example (5), in the final RG 5.87 by removing unnecessary language regarding the reasons for the aerial overflight.

Comment D-10: One commenter, referencing language in DG-5019, sec. C.6.2.k, indicated that including an example on the of photographing of facilities as not recordable in the safeguards event log could serve to desensitize security personnel to the reporting of potential suspicious activities. The commenter recommended deleting this example. (NEI1-A2-124)

NRC Response: The NRC agrees with the comment. The language in DG-5019, sec. C.6.2.k, has not been included in the final RG 5.87.

E.

Group E - Weapons Safety Assessment Comment E-1: One commenter, referencing language in USACE PDC TR NRC 06-10.1, ch.2, sec. 2-4, topic 34, suggested adding standards developed by local, State, and DCJS agencies as acceptable enhanced and specialized training. (B&W-11)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. Consistent with the final rule language in 10 CFR 73.15(f)(3), the NRC agrees that standards developed by State law enforcement agencies and State Division (or Department) of Criminal Justice Services training academies are acceptable sources of training standards that licensees may use in the development of their training and qualification plan to address training of licensee personnel utilizing enhanced weapons. The NRC does not agree that a licensee should be allowed to use training standards developed by local law enforcement agencies. The NRC has determined that using standards developed by local law enforcement agencies would not ensure sufficient consistency in the training provided to licensee personnel utilizing enhanced weapons. The NRC has discussed the language regarding training of licensee personnel utilizing enhanced weapons in the final NUREG-2264, Vol. 1, Ch. 2, sec. 2.4, question 32. This guidance makes clear that licensee training on the use of enhanced weapons must include applicable standards

38 from nationally-recognized firearms organizations or standard setting bodies or from standards developed by: (1) Federal agencies, such as the U.S. Department of Homeland Securitys Federal Law Enforcement Training Center, the U.S. Department of Energys National Training Center, and the U.S. Department of Defense; (2) State law enforcement training centers; or (3) State Division (or Department) of Criminal Justice Services (DCJS) Training Academies. A licensee may also wish to utilize appropriate training courses offered by these organizations.

Comment E-2: One commenter, referencing language in USACE PDC TR NRC 06-10.1, Ch. 2, sec. 2-8, example 1 after Table 2-8.2, suggested revising the example for an administrative building and not including impact to individuals 1. Impact to individuals - could be death (Tragic, consequence level 5). The commenter indicated that [w]hen completing the input tables it is assumed all buildings are un-occupied and include people that would normally be in these buildings under the people line item. (B&W-12)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. The NRC agrees that the input tables to the WSA should be completed with the assumption that the buildings are unoccupied, unless they are occupied 24-hours per day, (e.g., a continuously staffed alarm station). However, the NRC disagrees with the commenters suggestion to enter such individuals under the People line item. The NRC has relocated language in USACE PDC TR NRC 06-10.1, sec. 2-8, regarding the presence of personnel in buildings to the final NUREG-2264, Vol.1, Ch. 2, sec. 2.9, paragraph 8. Additionally, the NRC has not included a People line item in the final NUREG. Instead, the NRC has revised Vol. 1, Ch. 2, sec. 2.9, paragraph 8, to indicate that any individuals who would be in the buildings occupied 24-hours per day should be discussed in the population density information in sec. 2.9, questions 41 and

43. Accordingly, the NRC has also not included the notes after USACE PDC TR NRC 06-10.1, Ch. 2, sec. 2.8, Table 2-2, in the final NUREG-2264, Vol. 1, Ch. 2, including the example of an administrative building, as unnecessary.

Comment E-3: One commenter, referencing language in USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-6, suggested that when creating the initial Area Danger Ring (ADR) instead of using the maximum range of ammunition licensees use the lethal distance of the bullet. The commenter suggested that to determine the bullets lethal distance, the licensee records the bullets velocity and then uses a ballistics program to determine the bullets lethal range. The commenter noted that a clear representation of the bullets lethality would be provided by using the bullets energy instead of the bullets maximum range. (B&W-13)

NRC Response: The NRC agrees with the comment. The NRC agrees that the maximum lethal range of a given round of ammunition should be based upon the kinetic energy delivered on the target. Based on input provided by USACE, the NRC has determined that a delivered kinetic energy of 6.78 joule (J) [5.0 foot-pound force (ftlbf)] represents a 50 percent probability of the round penetrating human skin, which should be considered potentially lethal. The NRC has revised NUREG-2264, Vol. 1, Ch. 2, sec. 2-6, to indicate an applicant may use the potential lethal range at which a round would deliver 6.78 J (5.0 ftlbf) of energy to calculate an Initial Area Danger Ring (IADR). The NRC also considers acceptable an applicants use of a rounds maximum ballistic range to calculate an IADR. Accordingly, the NRC has revised the final NUREG-2264, Vol. 1, Ch. 2, sec. 2-6, to indicate that an applicant may use either the potential lethal range or the maximum ballistic range of the specified ammunition in creating an IADR.

39 Comment E-4: One commenter, referencing language in USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-8, question 39, suggested that a footnote number 3 should be added after the table on Key Facilities/Areas Inside the PA to address building occupancy. The commenter suggested the footnote read, Assume all buildings are un-occupied and include people that would normally be in the buildings under the people line item. (B&W-14)

NRC Response: The NRC agrees in part, and disagrees in part, with the comment. As discussed in the NRCs response to Comment E-2 above, the NRC agrees that buildings should be assumed to be un-occupied. However, the NRC disagrees with the use of a people line item to address continuously occupied buildings The NRC has discussed the language from USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-8, question 39, in NUREG-2264, Vol. 2, Ch. 4, sec. 4-8, Question 37. Accordingly, the NRC has added a new footnote number 1 in Question 37 which refers to Questions 41 and 43 for continuously occupied buildings. The NRC has renumbered footnote numbers 1 and 2 as footnotes numbers 2 and 3, respectively, at the end of each of the Questions 37, 38, and 39 input tables in the final NUREG-2264, Vol. 2, Ch. 4, sec. 4-8 and Vol. 4, Ch. 8, sec. 8-8.

Comment E-5: One commenter, referencing language in USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-8, questions 39, 40, 41, and 42, suggested on all input tables under Likelihood of Strike the pull down should allow the Licensee to select Never instead of Rare as an option. The commenter indicated that licensees may have items considered to be at risk inside the ADR that are physically protected from possible strikes. (B&W-15)

NRC Response: The NRC disagrees with the comment. The NRC has developed the WSA as a qualitative, rather than a quantitative, process. Therefore, the presence of the physical protection makes the likelihood of a strike rare, but the likelihood of a strike (possible impact of a round) cannot be totally excluded. Consequently, the NRC does not consider the use of Never as an appropriate input table drop-down option under Likelihood of Strike. Accordingly, the NRC has not made any changes to NUREG-2264, Vol. 2, Ch. 4, sec. 4-8, in response to this comment.

Comment E-6: One commenter, referencing language in USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-8, questions 39, 40, 41, and 42, suggested on all input tables under Consequence of Strike the pull-down should allow the Licensee to select None instead of Insignificant as an option. The commenter indicated that licensees may have items considered to be at risk inside the ADR that are physically protected from the consequence of strike. (B&W-16)

NRC Response: The NRC disagrees with the comment. As discussed in the NRCs response to Comment E-5 above, the likelihood of a strike on an item at risk may be insignificant but cannot be completely discounted. Therefore, there is still a potential consequence. The NRC does not consider the use of None as an appropriate input table drop-down option under Consequence of Strike. Accordingly, the NRC has not made any changes to NUREG-2264, Vol. 2, Ch. 4, sec. 4-8, in response to this comment.

Comment E-7: One commenter, referencing language in USACE PDC TR NRC 06-10.2, Ch. 2, sec. 2-8, questions 39, 40, 41, and 42, suggested on all input tables under Risk Level 0 should be a factor when utilizing the above options. The commenter indicated that [c]urrently the

40 Licensee would be given a 1 for a Rare and Insignificant even though there was no likelihood or consequence of strike and thus elevating the overall risk factor unnecessarily. (B&W-17)

NRC Response: The NRC disagrees with the comment. As discussed in Comment E-5 and E-6 above, the NRC considers that there may always be some degree of likelihood and some degree of consequence when enhanced weapons are discharged. Therefore, the NRC considers that some level of risk is always present. However, the goal of the WSA process is to identify potential risks of significance, and to minimize these risks with mitigating measures, including physical and procedural measures. Therefore, the NRC does not consider the use of zero input values as an appropriate methodology in the input table drop-down options.

Accordingly, the NRC has not made any changes to NUREG-2264, Vol. 2, Ch. 4, sec. 4-8, in response to this comment.

Comment E-8: One commenter, referencing language in USACE PDC TR NRC 06-10.3, Table 2-2.2, suggested categorizing select fire weapons with a Hazard Rating of 2 instead of a Hazard Rating of 3. The commenter indicated that [s]elect fire weapons are those that have the ability to select safe, semi-auto, or full auto/burst. Select fire weapons require the user to make a conscious decision and physically manipulate the weapon for the selected sustained rate of fire. Currently, the select fire weapons are categorized as full automatic machine guns.

(B&W-18)

NRC Response: The NRC disagrees with the comment. Weapons with the capability to fire either full-auto or burst capability (i.e., select fire) are classified as machine guns under the National Firearms Act (NFA). Consequently, the NRC has treated both full-auto and select-fire weapons as machine guns in the WSA NUREG. However, to improve clarity on this question, the NRC has added language to NUREG-2264, Vol. 1, Ch. 2, sec. 2-2, question 24, and Vol. 2, Ch. 4, sec. 4-2, question 24, to indicate that select-fire weapons are considered machine guns.

Accordingly, the NRC has not made any further changes to NUREG-2264 in response to this comment.

Comment E-9: One commenter, referencing language in USACE PDC TR NRC 06-10.3, sec. 2-12, suggested that [w]hen determining the hazard ratings licensee suggests combining the ratings for weapon type and ammo types to get a combined hazard rating. The commenter indicated that [c]urrently, the weapon and ammo hazard rating carry the same weight as the categories in the input tables. If a licensee selects a weapon type listed in the machine gun category with a hazard rating of 3 and an ammo type with a hazard rating of 4 their total hazard rating score prior to completing the input tables is a 7. Instead, the licensee suggested the combined hazard rating score would be a 4 and carry the same weight as the hazard ratings for the input tables. (B&W-19)

NRC Response: The NRC disagrees with the comment. The NRC considers the weapon type and ammunition type to be independent factors that are combined with other assigned values in the input tables and other rating factors in the WSA NUREGs calculation process. Appropriate weights are assigned to the values for both the weapons type and the ammunitions type; and the assigned values in the input tables and the sum of the values are evaluated by the licensee and reviewed by the NRC staff using weapon and ammunition hazard ratings in NUREG-2264, Vol. 3, Ch. 6, Tables 6-3 and 6-5, respectively. Accordingly, the NRC has not made any changes to NUREG-2264 in response to this comment.