|
Publication Date: 4/1/80
Pages: 39 Date Entered: 2/23/84 Title: STANDARD FORMAT AND CONTENT OF A LICENSEE PHYSICAL PROTECTION PLAN FOR STRATEGIC SPECIAL NUCLEAR MATERIAL IN TRANSIT April 1980 U.S. NUCLEAR REGULATORY COMMISSION REGULATORY GUIDE OFFICE OF STANDARDS DEVELOPMENT REGULATORY GUIDE 5.60 STANDARD FORMAT AND CONTENT OF A LICENSEE PHYSICAL PROTECTION PLAN FOR STRATEGIC SPECIAL NUCLEAR MATERIAL IN TRANSIT Use of the Standard Format The licensee should follow, as nearly as possible, the numbering system of the Standard Format in Parts I and II of this guide. if certain subsections are not applicable, this should be clearly stated and sufficient information should be provided to support that conclusion. The licensee may expand on the information provided, as necessary, to adequately cover any safeguards measures unique to the licensee's operation. Upon completing the plan, the licensee should use the table of contents of the Standard Format as a checklist to ensure that each subject has been addressed. Style and Composition A table of contents should be included in each submittal. The licensee should clearly and concisely present all information. Confusing or ambiguous statements and general statements of intent should be avoided. Definitions and abbreviations should be consistent throughout the submittal and in keeping with generally accepted usage. Wherever possible, duplication of information should be avoided. Thus, information already included in other NRC-required physical protection plans, e.g., the licensee's Site Physical Protection Plan and Safeguards Contingency Plan, may be covered by specific reference to the appropriate sections of those documents. Drawings, diagrams, maps, and tables should be used when information may be presented more adequately or conveniently by such means. These illustrations should be located in the section where they are first referenced or in appropriately referenced appendices. All information presented in drawings should be legible, symbols should be defined, and drawings should be large enough (not unduly reduced) to be read by an individual having normal vision. Physical Specifications of Submittals All material submitted in an application should conform to the following physical dimensions of page size, quality of paper and inks, numbering of pages, etc.: a. Paper Size Text pages: 8-1/2 x 11 inches. Drawings and graphics: 8-1/2 x 11 inches is preferred; however, a larger size is acceptable if the finished copy when folded does not exceed 8-1/2 x 11 inches. b. Paper Stock and Ink There should be suitable quality in substance, paper color, and ink density for handling and for reproduction by microfilming. c. Page Margins A margin of no less than 1 inch should be maintained on the top, bottom, and binding side of all pages submitted. d. Printing Composition: text pages should be single spaced. Type face and style: must be suitable for microfilming. Reproduction: may be mechanically or photographically reproduced. All pages of the text may be printed on both sides. Images should be printed head to head. e. Binding Pages should be punched for looseleaf ring binding. f. Page Numbering Pages should be numbered sequentially within each section. Do not number the entire report sequentially. g. Format References References to this Standard Format should be made by part, chapter, and section number. Procedures for Updating or Revising Pages The updating or revising of data and text should be on a replacement-page basis. The changed or revised portions of each page should be highlighted by a vertical line. The line should be in the margin opposite the binding margin for each line changed or added. All pages submitted to update, revise, or add pages to the report should indicate the date of the change. The transmittal letter should include an index page listing the pages to be inserted and the pages to be removed. When major changes or additions are made, pages for a revised table of contents should be provided. Number of Copies, Address, and Schedule for Submittal The licensee should submit six copies of his Physical Protection Plan to the Director, Office of Nuclear Material Safety and Safeguards, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, in accordance with the provisions of paragraph 73.20(c) of 10 CFR Part 73. Public Disclosure and Classification The NRC has determined that the public disclosure of the details of physical protection plans and programs is not in the public interest. Such details are withheld in accordance with paragraph 2.790(d) of 10 CFR Part 2. INTRODUCTION This regulatory guide describes the standard format and content suggested by the Nuclear Regulatory Commission (NRC) for use in preparing Physical Protection Plans for strategic special nuclear material (SSNM) in transit. By using this guide for preparing a Physical Protection Plan and Physical Protection Arrangements for Specific Shipments, the licensee will minimize administrative problems associated with the submittal, review, and approval of the plan. Conformance with this guide is not required by the NRC. A licensee who uses a format that will provide an equal level of completeness and detail and that will satisfy the requirements of the applicable NRC regulations may use his own format. However, the format and content herein presented are acceptable to the NRC staff. The Atomic Energy Act of 1954, as amended, directed the Atomic Energy Commission (AEC) to regulate the receipt, manufacture, production, transfer, possession, use, import, and export of special nuclear material (SNM) in order to protect the public health and safety and to provide for the common defense and security. The Energy Reorganization Act of 1974 transferred all the licensing and related regulatory functions of the AEC to the NRC. The principal requirements for physical protection of licensed activities against theft and radiological sabotage of SSNM in transit are contained in 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," Part 70, "Domestic Licensing of Special Nuclear Material," and Part 73, "Physical Protection of Plants and Materials." Paragraph 50.34(c) of 10 CFR Part 50 and paragraphs 70.22(g) and 70.22(h) of 10 CFR Part 70 identify the physical protection information that must be provided in a Physical Protection Plan as part of a license application. This plan is required in order for the licensee to comply with specific physical protection requirements of 10 CFR Part 73 and must be submitted with each application for a licensee to possess or process SSNM or for a license authorizing the transport or delivery of SSNM. The information in this guide applies to any the NRC licensee or applicant for an NRC license who anticipates transporting or delivering uranium-235 (contained in uranium enriched to 20 percent or more in the U-235 isotope), uranium-233, or plutonium alone or in any combination in a quantity of 5000 grams or more, computed by the formula: grams = (grams contained U-235) + 2.5 (grams U-233 + grams plutonium). As developments and changes in the nuclear industry occur, the Commission's requirements for information may need modification. Revisions to this Standard Format will be made, as necessary, to accommodate these changes. Purpose and Applicability This regulatory guide has been prepared as an aid to uniformity and completeness in preparing and reviewing the Physical Protection Plan, which is a prerequisite for a license for transporting or delivering SSNM. Amplification and clarification of the protection arrangements to be made for each individual shipment of SSNM are also provided. The information requested in this Standard Format is the minimum necessary for an acceptable Physical Protection Plan. Additional information may be required during the staff review of a particular plan. It is also the licensee's responsibility to be awaae of applicable new and revised NRC regulations. The information provided should be up to date with respect to the state of technology for the physical protection techniques and systems that the licensee proposes to use. Information and procedures that are delineated in the regulatory guides in Division 5, "Materials and Plant Protection," and that are appropriately contained in certain sections of the licensee's Physical Protection Plan for fixed sites may be incorporated by reference. Upon receipt of a Physical Protection Plan for review and approval, the NRC staff will perform a preliminary review to determine whether the plan is reasonably complete. The staff will use the Standard Format as a guideline to identify the necessary information. If a licensee does not provide a reasonably complete presentation of the necessary information, further review of the plan may be suspended until the needed information is provided. Organization of This Document This document is divided into two parts. Part I provides the standard format and content to be used for submittals of the Physical Protection Plans for SSNM in transit. Each section in Part I is referenced to the portions of the regulations that apply to that section, the reference provided in brackets following the section heading. Also, the sections in this part are divided into two subsections entitled "Intent" and "Content." The "Intent" subsections are exclusively explanatory in nature and are provided to give the licensee additional information regarding the purpose for including such provisions in the regulations and the relationships between the different provisions. Examples of subsystems and procedures that may be used in different situations to achieve the capabilities required in the regulations are also provided, including references to pertinent sections of the reference safeguards system described in section 73.26. This type of information should aid the licensee in designing a well-balanced, integrated physical protection system that can meet all the performance capability requirements. The "Content" subsections provide detailed guidance on the information to be included in the Physical Protection Plan submittals and the standard format to be used to ensure that the plans submitted are complete and in a form that can be easily reviewed by the NRC staff. Part II contains standard format and content information relating to submittals of Physical Protection Arrangements for Specific Shipments. These submittals are intended to supplement the Physical Protection Plan submittal with changes in physical protection subsystems and procedures that will be effective for a given shipment plus specific scheduling information and other arrangements that cannot be determined very far in advance of the date for a specific shipment. In addition to the Physical Protection Plan and the arrangements for specific shipments, licensees are also required to submit plans for guard qualification and training programs and Safeguards Contingency Plans. All these plans together comprise the physical protection system required to be provided by licensees who are involved in the transportation of strategic special nuclear material; therefore, they all should be consistent with one another. Thus the Physical Protection Plan for transport of SSNM and individual submittals of Physical Protection Arrangements for Specific Shipments should be appropriately marked and handled accordingly. Other related proprietary or classified information should be clearly identified and submitted in accordance with applicable directives. Each such submittal of proprietary or classified information should be accompanied by the licensee's detailed reasons and justifications for requesting exemption from public disclosure, as required in paragraph 2.790(b) of 10 CFR Part 2. Compatibility The licensee should ensure that the Physical Protection Plan for transport of SSNM is compatible with applicable parts of all other physical protection plans, including the Site Physical Protection Plan, separate submittals of Physical Protection Arrangements for Specific Shipments, the Safeguards Contingency Plan, and plans for guard qualification and training programs. Chapter 1 GENERAL ISSUES 1.1 Purpose and Scope Intent The primary purpose of a licensee's plan for the physical protection of strategic special nuclear material (SSNM) in transit is to assist in the NRC review of the adequacy of the licensee's physical protection system relative to the particular routes or itineraries proposed in the plan. However, after the plan has been approved by the NRC, it could become a guide for the licensee's security personnel in the implementation of the licensee's physical protection system for SSNM in transit. Content Describe the purpose of the Physical Protection Plan and characterize its contents. Indicate the additional types of information to be found in the Physical Protection Arrangements for Specific Shipments (prepared for each shipment in accordance with Part II of this guide) that would complete the description of the physical protection system for a given shipment and that would describe in detail the actual shipment itinerary and schedule. 1.2 Safeguards Contingency Plan [Section 73.25(d)(1)(ii), (d)(1)(iii), Appendix C to Part 73]Intent A predetermined plan to respond to safeguards contingency events is required to be prepared, based on personnel and other physical protection resources described in the Physical Protection Plan for SSNM in transit. Specific requirements for the contingency plan are provided in Appendix C, "Licensee Safeguards Contingency Plans," to 10 CFR Part 73. Regulatory Guide 5.56, "Standard Format and Content of Safeguards Contingency Plans for Transportation," provides guidance for the preparation of transportation contingency plans. The licensee is reminded that all three submissions--the Physical Protection Plan, the Physical Protection Arrangements for Specific Shipments, and the Safeguards Contingency Plan--together describe the system for physical protection of each particular shipment. They should be developed and maintained to be completely consistent with each other for each shipment. Content Describe briefly the Safeguards Contingency Plan prepared in accordance with Appendix C to 10 CFR Part 73. Relate it to the Physical Protection Plan and Physical Protection Arrangements for Specific Shipments. 1.3 Security Organization Training, Equipment, and Qualifications [Section73.25(d)(1)(i), (d)(1(iv), (d)(1)(v), Appendix B to Part 73]Intent The purpose of these requirements for the qualification and training of security organization personnel is to ensure that security organization members will be fully qualified, equipped, and trained and thoroughly familiar with the procedures and equipment they will use during the progress of a shipment. These requirements are detailed in Appendix B, "General Criteria for Security Personnel," to 10 CFR Part 73 and are cited also in the reference system [section73.26(d)(4) and (d)(5)]. The requirements generally are that each security organization member be able to perform at least those duties described in the Physical Protection Plan that he might reasonably be assigned. The specific description of qualification and training of security organization members will be provided as part of a separately prepared and submitted document entitled "Transportation Security Organization Training, Equipment, and Qualifications Plan." That plan should be consistent with the Physical Protection Plan with regard to the numbers of personnel, the equipment described, and the tasks to be performed by security organization personnel. In particular, the physical and performance characteristics of firearms carried by or immediately available to armed escorts and armed response personnel are described in Appendix B to 10 CFR Part 73. Although all three types of weapons described--semiautomatic rifles, shotguns, and sidearms--would normally be expected to be carried by, or immediately available to, these personnel for the physical protection of road and rail shipments and at transfer points, sidearms alone would normally be considered sufficient armament for armed escorts on aircraft and ships. Content Affirm that a Transportation Security Organization Training, Equipment, and Qualifications Plan has been submitted to the NRC according to the requirements set forth in Appendix B to 10 CFR Part 73. Affirm also that such plan is consistent with this plan as to equipment and the number of security personnel required to implement the physical protection system described herein. Briefly relate the two plans to ensure that all members of the security organization will be adequately qualified and trained to perform the duties normally assigned them. Refer to the Transportation Security Organization Training, Equipment, and Qualifications Plan to describe the equipment (e.g., armored escort vehicles, firearms, night vision equipment) that will be used by the escorts to protect themselves as well as to perform the tasks assigned to them. 1.4 Security Management [Section73.25(d)(1)(i)]Intent Security organization management is a crucial component of the physical protection system. Some specific security management considerations are provided in paragraphs 73.26(d)(2) and (d)(3) of the reference system. The management of the security organization is the vital link between the licensee and those responsible for direct implementation of the overall plan for physical protection of a shipment. Thus, it is necessary to have a detailed description of the licensee's plan for management of the security organization to understand fully how the Physical Protection Plan will be implemented. Content Refer to the Security Management section of the Transportation Security Organization Training, Equipment, and Qualifications Plan to briefly describe the security organization management structure. Affirm that this structure will ensure that the physical protection system will not fail to function for lack of the presence of a member of the security organization with proper authority to conduct security-related functions performed at the movement control center. 1.5 Testing and Maintenance Program [Section 73.20(b)(3)]Intent This provision requires a testing and maintenance program. This program is to ensure that all activities and devices on which the physical protection system depends to maintain shipment security continue to be available to the physical protection system in a reliable and effective manner. It also is intended to ensure that the level of protection represented in the Physical Protection Plan submitted does not deteriorate through neglect, disuse, or inappropriate substitution of system components. Content Describe the program to regularly test and inspect all components (design features, equipment, vehicles, and procedures) of the physical protection system to ensure that the design, construction, and operation of all security-related components will continue to be substantially as described in the currently approved Physical Protection Plans. Include a description of how these programs will be managed, the lines of authority for such management, and the schedule for licensee management review of the adequacy of the physical protection system. Describe the program to provide routine preventive maintenance for all security-related equipment, vehicles, and design features in the physical protection system. Include the components covered by the program and the operations and supervisory personnel who will implement the program. Also describe the capability of the escort force to make emergency repairs en route. Describe the circumstances under which such emergency repairs might be required. 1.6 Security Records [Section 73.70]Intent Certain types of records regarding shipments of SSNM must be kept (see Section 73.70). These requirements are intended to produce a verifiable record to show that appropriate detailed planning functions were carried out for each shipment and to expedite timely and efficient tracing of any missing shipment. Content Describe the recordkeeping program designed to keep track of all licensee personnel who were authorized access to SSNM in transit, other persons who were authorized access, other persons who may have had access to SSNM in transit, and other security-related matters. Include documentation of security assignments, tests, inspections, and audits performed on the physical protection system. Also include logs of previous shipments and other information relating to specific routes and modes of transport such as carriers, major roads used, or flight numbers, as specifically required by Section 73.70. 1.7 Reports to NRC [Section 73.71]Intent This provision is designed to ensure that the NRC will be apprised of all security-related incidents that occur during shipments of SSNM. Thus the NRC will be able to continually update its knowledge, both of threats posed to such shipments and of the ability of existing physical protection systems to deal with these threats. Content Describe the procedures to ensure that NRC is provided with a full accounting of all contingency incidents necessitating reports to the NRC, as detailed in Section 73.71. Include a description of the management structure and procedures to ensure compliance. 1.8 Redundancy and Diversity [Section 73.20(b)(2), Section 73.25(d)(4)]Intent It is required that the physical protection system be designed with redundant and diverse measures. This is to ensure that the system will remain capable of providing the necessary level of protection under adverse conditions that could cause the failure of some system elements. Redundancy means providing several measures (which may be the same measure duplicated) to perform the same function or subfunction. This would prevent failure of the entire system if there were failure of one or more system elements. Diversity means providing several different kinds or types of measures that contribute to the performance of a particular security function or subfunction. Providing different measures with differing characteristics (e.g., sensitivities, failure modes, strengths, weaknesses) ensures continued performance of a given capability despite adverse operational conditions, attempts at system sabotage, or exploitation of a given measure. The reference system provides redundancy in communications between the escort force and the movement control center (paragraph 73.26(i)(6) for road shipments and paragraph 73.26(k)(4) for rail shipments). The reference system also suggests "corrective action procedures and compensatory measures" to ensure that "the effectiveness of the physical protection system is not reduced by any single failure or other contingencies affecting the operation of the physical protection related equipment or structures" [paragraph 73.26(h)(5)]. The licensee also must be able to communicate with local law enforcement authorities if the escorts are attacked. Routine operating procedures must be designed to ensure that a single adversary attack cannot destroy the armed escorts' capability to notify the local law enforcement authorities of the need for assistance [paragraph 73.25(d)(4)]. (This would be accomplished in the case of road shipments, for example, by proper spacing and randomly varying the distances between the transport and the escort vehicles.) The assurance of the survivability of a communications capability would normally be included under the general redundancy and diversity requirements of paragraph 73.20(b)(2). However, the integrity of this particular communications capability is considered so crucial to the primary mission of the physical protection system that it has been stated as a separate capability in paragraph 73.25(d)(4). This capability is also referred to in the reference system [paragraph 73.26(f)(2)] in the context of transfer operations procedures. Generally, the licensee has the responsibility for determining where measures for redundancy and diversity may need to be designed into the physical protection system and for designing the system accordingly. Content Describe the portions of the physical protection system that have been reinforced with redundant or diverse measures to provide assurance of continued capability to protect a shipment during adverse conditions or attacks. Include, in particular, a description of physical protection subsystems and procedures that ensure that a single adversary attack cannot keep the armed escorts from notifying local law enforcement authorities of the need for assistance. PART I PHYSICAL PROTECTION PLAN Chapter 2 SHIPMENT PLANNING AND CONTROL 2.1 Preplanning of Shipment Itineraries [Sections 73.25(b)(1)(i) and (d)(3)]Intent The intent of this requirement for preplanning of shipment itineraries is to decrease the vulnerability of SSNM shipments and to increase the ability of response forces to assist the escorts if a problem arises. Route preplanning can help accomplish this objective. It can determine areas where a shipment would be vulnerable to attack (e.g., scenes of recent natural disasters, labor dispute areas) and avoid these areas. It can minimize the stops required. It can minimize layover (storage) time. It can select routes allowing minimum interruption in communications with the movement control center. The route itinerary and scheduling information resulting from preplanning can familiarize escort and movement control center personnel with the route for a particular shipment. This familiarity will help ensure quick response to any emergencies that may arise. Establishing liaison with local law enforcement authorities (LLEAs) to arrange for assistance along routes will ensure that the LLEAs are familiarized beforehand with the types of assistance they could be asked to provide SSNM carriers. The preplanning function will usually involve the determination and detailed consideration of several alternative routes and rest stops along each route that generally would be acceptable for SSNM shipments. However, the final selection of one of these alternative routes or of particular rest stops for a specific shipment will depend on the most current information available about conditions along each route. Such information will be obtained and maintained according to the procedures described in Section 2.2 of the Physical Protection Plan (see Section 2.2 of Part I of this guide). Sufficient flexibility should be incorporated in the planning of shipments to avoid regular patterns as suggested in the reference system [paragraph 73.26(b)(1)]. Other specific considerations related to the preplanning capability are in the following sections of the reference system: paragraphs 73.26(b)(2) and (3) and 73.26(c) for general information; paragraph 73.26(i)(1) for road shipments; paragraphs 73.26(j)(1), (2), (4), and (8) for air shipments; paragraphs 73.26(k)(1) and (3) for rail shipments; and paragraphs 73.26(l)(1), (2), (3), (5), (6), and (8) for shipments by sea. Content 1. Planning and Scheduling Considerations. Discuss provisions to ensure that the transit times of SSNM shipments will be minimized and that routes will be selected to avoid areas of natural disaster, civil disorder, or other similar threats to the security of the shipment. Also discuss provisions to ensure that shipments will encounter minimal, if any, storage times and that delivery will be made to the receiver as soon as possible after arrival at the final destination. 2. Itinerary Information. The itineraries (or routes) described in this section of the plan should show the following detail: (a) that the licensee has a comprehensive understanding of conditions and situations that may occur on the route, (b) that the licensee will use this knowledge to avoid areas imposing excessive and unnecessary demands on the escort force or unnecessarily increasing the vulnerability of the shipment, and (c) that the licensee will be prepared to take any necessary action when the shipment must pass through areas of high vulnerability. Information on planned itineraries routinely used in the transport of the SSNM covered by this Physical Protection Plan should be presented in this section, either directly or by referring to the pertinent appendices of the plan. For brevity and clarity of presentation in the body of the plan, this information is best presented in appendices. Information contained in the licensee's Safeguards Contingency Plan may be referenced to the extent it is applicable. Separate appendices or sections should be used for each itinerary. These may be referred to in preparing submittals of Physical Protection Arrangements for Specific Shipments while noting any changes or updating route information, as necessary. (See Regulatory Guide 5.57, "Shipping and Receiving Control of Special Nuclear Material." See also Regulatory Guide 5.56 for examples of charts and tables describing itineraries.) For each route, the itinerary information should include route segment identifications; pertinent time and distance factors; and locations of LLEA facilities, possible rest stops, transfer points, and points where there are changes in transportation mode. If some of the information requested is not available at the time the plan is submitted, it may be deferred and included instead in the Physical Protection Arrangements for Specific Shipments. Tables and charts needed for presentation of the itinerary information are described below: a. Route Overview--a graphic display of the overall route, including road, rail, air, and sea transportation segments. It may be presented on one or more sheets. It may be a line diagram or it may be depicted on a road or topographical map. The map or diagram should be large enough in scale to indicate clearly the pertinent information just described. The planned route segments should be indicated clearly on the display. They should be easily correlated with the pertinent LLEAs and recognized geographic features (e.g., roads, terminals, waterways) forming the boundaries of the segments or otherwise referred to in the plan. The segments may be defined according to the boundaries of the jurisdictions of the pertinent LLEAs. The origin and destination of the itinerary should be clearly indicated. Alternative route segments may be appropriately indicated as alternative route segments of the original route or may be described separately. Route segments should be numbered, or otherwise identified, by an appropriate code. b. Route Segment Descriptions--a table showing the following information for each route segment: (1) Number or identification code of the route segment. (2) Segment boundaries (start and end points). (3) Number of persons included in escort force. Describe also the source and number of armed response personnel other than escort force members expected to be available at transfer or other points included in the segment. Refer, if necessary, to the Transportation Security Organization Training, Equipment, and Qualifications Plan. (4) Average estimated time to complete the segment. (5) Provisions for escort force personnel to sleep or rest during traversal of the segment. Locations of possible refueling and rest stops on the route. (6) Departure points for leaving planned route and embarking upon alternative route segments. c. Liaisons with LLEAs--a table listing the LLEA information for each route segment. Include the LLEA organization name and the person contacted (plus his title and phone number within the organization). Briefly describe the arrangement that exists between the LLEA and the licensee concerning possible calls for assistance. Index this information to the numbering or other code used for identifying route segments above. The licensee should describe the information given LLEA organizations to familiarize their personnel with the unique types of challenges they may face if called to aid a shipment carrier within their jurisdiction. 2.2 Maintaining Knowledge of Route Conditions and Shipment Status [Section 73.25(b)(1)(ii) and (iii)]Intent The provision for updating route information is to ensure that the route selection process uses the most up-to-date information available to avoid placing the shipment on a course with unusual hazards to shipment security. After the shipment has begun to move, further updating of route information ensures that development of hazardous conditions that could affect shipment security is discovered soon enough that itinerary changes may be considered to allow the security organization to avoid, or prepare for coping with, such conditions. The provision for updating knowledge of shipment status is intended to ensure that the movement control center becomes aware of any unusual conditions encountered by the escort force during the shipment. This provision is also designed to allow a full understanding of reasons for any disruption in communications capability with the transport and its escort force because of emergency or equipment failure. Detailed guidance to response forces on where to begin looking for a missing SSNM shipment is also to be provided. Subsystems and procedures for maintaining knowledge of route conditions as the shipment progresses may include elements independent of the escort force itself to ensure that collection of such information is obtained in a timely fashion, despite other duties escorts will have to perform during the shipment. Such procedures may include contacts with LLEAs, local news media, wire services, or weather services. Also, in the case of road shipments, escorts may be dispatched ahead of the transport to ascertain that upcoming rest or fuel stations, transfer points, or other critical locations are free of suspicious activity, civil disorders, or other threatening conditions for which special precautions must be taken or preparations made. The physical protection system may include procedures for the movement control center to obtain shipment position and status information from the escort force on a prescheduled basis that has been mutually agreed on. This will allow determining as soon as possible when difficulties that prevent direct communications arise. Such procedures may involve, for example, check-in reports by the escort force at periodic time intervals or at predetermined milestones such as at all transport stops, at transfer points, or on crossing over from one route segment to another. These procedures may also incorporate a method for the movement control center to determine whether updating information they receive on the status of the shipment is authentic or is provided under duress. Also, various means may be employed to ensure that the movement control center becomes aware of when the updating information on the shipment status becomes critically overdue. The following sections in the reference system apply to the suggested capability for updating the information on the status of the shipment: paragraph 73.26(i)(6) for road shipments, paragraph 73.26(k)(4) for rail shipments, and paragraph 73.26(l)(7) for sea shipments. Note that although there is no suggestion for periodic check-in reports during the air segments of a shipment, the movement control center must still possess the capability for maintaining knowledge of the status of air shipments. This function, however, may be performed by periodic check-ins or, independently of the shipment, by the movement control center's monitoring flight status through airport authorities to determine if the flight is overdue or still on course. Also, check-in reports by the escort force immediately before takeoff and just after landing could narrowly circumscribe when the aircraft is in actual flight. Content Describe subsystems and procedures employed by the movement control center to maintain knowledge of route conditions from the time shortly before the shipment begins movement through the duration of the shipment and to determine the significance of such information for the continued safety and security of the shipment. This description should include the means employed to obtain information from diverse sources and to filter it to determine its significance, as well as the means to store and retrieve previously obtained information, if applicable. Describe procedures employed by members of the escort force to obtain, while en route, information regarding upcoming route conditions. Describe any means used to determine information source authenticity and whether information obtained directly from the escort force is being provided under duress. Also describe the process for ensuring that appropriate action will be taken if the required information is not obtained in a timely manner (i.e., according to preplanned schedule). Refer, if necessary, to the Responsibility Matrix and other parts of the Safeguards Contingency Plan. 2.3 Determination of Alternative Itineraries [Section 73.25(b)(1)(iv)]Intent During a shipment, events that would affect the shipment's security may occur, were the shipment to continue upon its predetermined itinerary. In such cases, prudence may dictate certain changes in the schedule or itinerary that would decrease the vulnerability of the shipment. This provision is designed to ensure that a capability to rapidly and intelligently determine and communicate such changes is established in advance. It would probably be most desirable if such changes were made within the context of alternative route plans already prepared for use in such contingencies and already familiar to the escort force and the movement control center. To ensure the continuity of the high level of protection provided the shipment, these procedures also will usually include contacting LLEAs to inform them of any changes in shipment schedule or itinerary that would affect them. Content Describe procedures to determine and implement alternative itineraries when such changes become necessary. Describe the process by which the decision to change an itinerary or schedule is made. Specify who has final authority to make such decisions. Refer, if desired, to the appropriate sections of the Safeguards Contingency Plan. Chapter 3 DETECTION AND DELAY OF UNAUTHORIZED ACCESS OR MATERIALS INTRODUCTION BY STEALTH OR FORCE These sections cover detection and delay of unauthorized access or introduction of materials into the vicinity of SSNM or SSNM transports by stealth or force when the transport is either moving or stationary. 3.1 Establishment of Controlled Access Areas [Section 73.25(b)(2)]Intent These provisions are designed to set up a restricted area surrounding the transport or the SSNM (when located outside the transport or aboard moving transports) in order to isolate the transport or SSNM and decrease the number of personnel, materials, equipment, and vehicles allowed to come in contact with the transport or the SSNM. This controlled access area simplifies preventing unauthorized access of persons or materials into the transport or into the immediate vicinity of the SSNM. It ensures that only persons or materials required to have such access to perform essential functions are in the area at any given time. Unauthorized persons would be discouraged from attempts at penetrating the controlled access area and normally would be detained at its perimeter. Establishing controlled access areas would have the following effects: (1) it would limit opportunities for attempted unauthorized access to the transport or SSNM by stealth, (2) it would increase the probability of detection of persons possessing significant amounts of tools, explosives, or other unauthorized materials useful for purposes of committing radiological sabotage or of gaining unauthorized access to the SSNM, and (3) it would ensure that attempts to penetrate the transport or to misappropriate SSNM by force will be resisted sooner with more chance of preventing theft or sabotage. Controlled access areas are defined in paragraph 73.2(z) in terms of two basic attributes: (1) there must be a means of demarcating the area's boundaries that is clear to both authorized and unauthorized personnel and (2) there must be some way of controlling access to the area at all times to ensure that unauthorized personnel are not admitted. The plan should address the establishment of controlled access areas, where applicable, in two somewhat different types of situations, i.e., both at transport stops and aboard moving transports. Some types of transports such as certain aircraft, rail cars, and road transports may not need to be protected by the establishment of a controlled access area while they are in motion. This is because the cargo compartments of such transports are not normally accessible to persons on board the moving transport and, further, would be inaccessible to persons on the ground by virtue of the transport's motion. Special provisions for protection may still be required in instances where the transport slows sufficiently to allow access (e.g., slow-moving trains, road transports at toll booths or traffic signals). Aboard trains or large ocean-going vessels where unauthorized persons may possibly gain access to the SSNM, controlled access areas may need to be established. A secured cargo compartment may serve as a controlled access area on board such moving transports. In considering the space to be included in a controlled access area aboard a moving transport, the precise object to be considered the "transport" may vary according to the mode of transportation involved. "Transport," as defined in paragraph 73.2(cc), includes any vehicle for "land, sea, or air conveyance or modules for these conveyances such as rail cars or standardized cargo containers." In the case of dedicated truck or aircraft, the entire vehicle can be considered the transport. Sometimes, a controlled access area must be established on board a nondedicated transport in order to isolate the SSNM from unauthorized persons occupying the remainder of the space on the transport (if it is physically possible for such persons to gain access to the SSNM while the transport is in motion). In the cases of large oceangoing vessels or a long train of rail cars, isolation of the entire conveyance may be impractical. Instead, aboard a specially designed ship (container ship), the standard multimode shipping container (which alternately serves as both a truck trailer or rail car mountable container) may be considered the transport. For rail transportation, the particular rail car containing the SSNM may be considered the transport. In these cases, the function of the controlled access area is to isolate the transport module (i.e., the rail car or standard shipping container) from the remainder of the conveyance of which it is a part. Alternatively, a secured cargo compartment may serve as a controlled access area aboard a moving transport. Access detection subsystems and procedures are required to detect penetrations of controlled access areas by unauthorized persons or materials. Detection is normally expected to occur at the time of penetration, which would permit a response sufficiently timely and effective to prevent the penetration (or attempted penetration) from resulting in the theft of SSNM and limit the opportunity for a potential adversary to complete actions of radiological sabotage. Of course, the considerations that persons or materials may already have been introduced aboard a moving transport for the purposes of sabotaging the transport, and that it may not be practical for the escorts to maintain effective control over the entire transport, limit the chances for protecting against sabotage to the entire transport. However, the physical protection system may effectively protect against actions of force and stealth aimed specifically at the SSNM or the transport module in which the SSNM is contained. This protection would be designed to limit the opportunities for a potential adversary to cause significant dispersals of SSNM by direct attack on the transport or on the SSNM through actions of stealth or force. Detection of unauthorized penetrations of controlled access areas at transport stops will normally be accomplished by escorts who will maintain constant surveillance over the SSNM or transport. For longer periods such as overnight storage, intrusion alarms may be useful. Storage of the shipment within a protected area maintained at a fixed site by an NRC licensee would satisfy the requirements for a controlled access area. The reference system delineates several safeguards measures that usually will be included in the physical protection system to satisfy the performance capability requirements for the detection of unauthorized penetrations of controlled access areas at transport stops and transfer points [paragraphs 73.26(f)(2), (i)(7), (j)(3), (k)(1), and (l)(4)]. Aboard moving transports, either guard surveillance (either direct or by using closed circuit television (CCTV)) or intrusion alarms may be used to detect unauthorized penetrations of the controlled access area. If a secured cargo compartment or a standard cargo container is used and is determined to be generally not accessible to unauthorized personnel (e.g., due to other containers stacked around and above it), a procedure for the use of tamperindicating seals and inspections may be a suitable means of access detection provided the SSNM is placed under constant surveillance whenever access by unauthorized persons becomes possible. Locks and seals on the containers would normally be examined at these times. (Locks and seals on individual packages or containers of SSNM could also be used to establish continued shipment integrity, should the shipping container seals be damaged in transit.) Communication and assessment functions associated with the access detection subsystems and procedures for controlled access areas should be capable of facilitating an appropriate response to detect penetration or attempted penetration of a controlled access area. This response is to be capable of meeting the threat described in paragraph 73.1(a). The details of the performance of these communications and assessment functions are to be discussed in the Safeguards Contingency Plan in the context of the overall response. Content 1. Controlled Access Areas at Transport Stops. Describe the different types of controlled access areas that will need to be established at transport stops, and describe the criteria to be used for selection of appropriate locations for such stops. Include those for rest stops and emergency stops for road transportation, intermediate ports of call for sea shipments, transfer points, etc. (Refer to the Safeguards Contingency Plan as necessary.) For each type of controlled access area described, include the transportation modes involved and the occasion for the transport stop being made. Briefly describe significant adverse conditions under which the controlled access area will be expected to function (e.g., crowds, traffic, availability of nearby cover). Provide for each of the different types of controlled access areas described, in combination or separately as appropriate, the following information: a. Demarcation of Controlled Access Areas. Describe how each controlled access area is to be demarcated in order to indicate to escort personnel and to other authorized and unauthorized persons that a particular area has been defined and that such area is restricted to authorized personnel only. Some examples include cordoning off the area with posted guards or erecting temporary barricades. b. Implementation Procedures. Describe procedures and criteria for escort personnel to select appropriate locations and arrangements (to the extent possible) for establishing controlled access areas. Describe procedures to be followed in establishing such areas with minimum delay when the specified occasion arises. The configuration and approximate dimensions of the controlled access area to be established in relationship to the transport or the SSNM should be included in this description. c. Access Control. Describe the barrier subsystems, procedures, or other devices employed to ensure that only authorized personnel will be allowed access to the controlled access area. These may include posted guards (escort personnel) responsible for detaining unauthorized persons or materials at the boundary of the controlled access area, appropriate physical barriers, or other means for delaying access to the controlled access area. d. Access Detection. Describe subsystems and procedures employed to detect and communicate any unauthorized penetration (or such attempts) of the controlled access area by persons, vehicles, or materials and to whom such detections would be communicated. Refer to the Responsibility Matrix of the Safeguards Contingency Plan as necessary. Discuss the interrelationship among the access control and detection subsystems and the procedures described above and the armed response capabilities in order to demonstrate that the combined systems can satisfy the general performance requirements of paragraph 73.20(a). 2. Controlled Access Areas Aboard Moving Transports. Provide descriptions of the types of controlled access areas to be established aboard moving transports. Include transportation mode involved, location of SSNM aboard the transport, and access points where unauthorized persons could gain access or unauthorized materials could be introduced into the vicinity of the SSNM in the absence of appropriate controls. Provide for each of the types of controlled access areas to be established aboard moving transports, in combination or separately as appropriate, the following information, similar to that included in descriptions of controlled access areas at transport stops: (a) demarcation of controlled access areas, (b) implementation procedures, (c) access control, and (d) access detection. Discuss the interrelationships among the access control and detection subsystems and procedures described above and the escort force (or other armed response personnel) response capabilities in order to demonstrate that the combined systems can satisfy the general performance requirements of paragraph 73.20(a). Refer to the Safeguards Contingency Plan as necessary. 3.2 Transport Features to Delay Access [Section 73.25(c)(2)(i)]Intent This provision is intended to ensure that the physical protection system takes into account in its overall scheme the degree of protection afforded by transport design features. Where possible, it is also intended to suggest the inclusion of design features in special-purpose transport vehicles that maximize the delay an adversary might encounter in attempting unauthorized penetration of the transport. Generally, only road transport vehicles will be specifically designed to include features that delay access to the cargo compartment in the event of attempted penetration through stealth or force. Such features in road transport vehicles are provided for in the reference system [paragraph 73.26(i)(3)]. However, licensees may also rely on the design features of other types of transports in the design of the overall physical protection system. Some examples are the structural strength of a particular type of rail car or affixing certain equipment to or temporarily altering the transport to improve its resistance to penetration. Additional locks may be installed. All such delay features may be considered as transport features relevant to this provision to the extent that they are specifically intended or relied on to delay the adversary's attempt at transport penetration. Content Describe transport(s) used to carry the SSNM. Describe design features affecting transport penetration resistance. State whether transportation vehicles or modules will be under the control of the licensee (owned, leased, or rented) or under the control of a contract or common carrier. Include drawings and specifications that describe the penetration-resistant features of the portion of the transport used to carry the SSNM (e.g., the means of securing access points and the construction of the transport's body shell). Penetration from all accessible points of attack, including the top and undersides of transports, should be considered. (See Regulatory Guide 5.31, "Specially Designed Vehicle with Armed Guards for Road Shipment of Special Nuclear Material.")3.3 Access Detection for Transports [Section 73.25(c)(2)(ii) and (c)(2)(iii)]Intent These provisions were designed to ensure that a detection capability that applies strictly to the transport, in addition to the detection capability associated with the controlled access area that may surround the transport, is provided in the physical protection system. This is to take into account that certain persons who may be authorized to enter the controlled access area may not be authorized to enter the transport itself. Some examples include transport operating crew members on ships, airplanes, and trains or transport service or maintenance personnel at stops. The smaller perimeter of the transport, in comparison with the controlled access area surrounding it, and the usually better-defined boundaries of the transport make practical a wider variety of access detection subsystems and procedures than might ordinarily be effectively employed in the case of a controlled access area. Access detection subsystems and procedures are needed under these provisions for many reasons. Unauthorized tampering with transports and cargo containers can be detected. Any unauthorized presence of persons or materials and any unauthorized attempt to penetrate the transport can be detected, assessed, and communicated so that the response can prevent SSNM theft. Tamper seals and inspections aid detection of tampering. Intrusion alarm systems and direct or remote (e.g., CCTV) surveillance aid detection of the actual presence of unauthorized persons within or adjacent to the transport or of attempts at unauthorized penetration. Seals do not detect SSNM theft during the act but do provide evidence that penetration has or has not occurred in the interims between inspections and can provide a useful record for tracing lost shipments should some SSNM be found missing. This nonpenetration assurance is also useful for eliminating the need to undertake more detailed inspection of transports in order to establish that there are no unauthorized persons or materials aboard a transport before loading if the transport has been previously inspected and sealed. Detection of unauthorized access to controlled access areas is generally limited to surveillance by escorts; however, remotely or locally annunciated intrusion alarm systems become practical and feasible for transports. The same individuals (escorts) may be made responsible for detecting unauthorized access to both the controlled access area and the transport contained within it. However, this provision makes the licensee responsible for demonstrating that these two functions can be adequately performed by the same personnel simultaneously. The licensee, for-example, would have to demonstrate that personnel within the controlled access area would not be likely to remain undetected in their attempts to covertly gain unauthorized access to the transport while the escorts were busy watching persons outside the controlled access area. Content 1. Tamper Indication [Section 73.25(c)(2)(ii)]. Describe the inspection and detection subsystems and procedures to detect unauthorized tampering with transports and cargo containers during transit and before loading. Include schedules for inspections and tamper-indicating features of transport and physical protection hardware. Acceptable devices and procedures for satisfying these provisions are contained in Regulatory Guide 5.15, "Security Seals for the Protection and Control of Special Nuclear Material." 2. Transport Access Detection [Section 73.25(c)(2)(iii)]. Describe the surveillance subsystems and procedures that will be used to detect, assess, and communicate any unauthorized presence of persons or materials within the transport and any unauthorized attempt to penetrate the transport. Also describe those that ensure that no unauthorized persons or materials are on board the transport before SSNM loading or on the escort vehicles (for road shipments) immediately before the trip begins. Specify which subsystems and procedures are to be used under given conditions and circumstances to ensure that a surveillance or detection capability exists at all times during shipment. If an alarm system is used, describe its tamper-resistant features and the location and means of annunciation. Relate the response to any annunciation of an alarm system or to any alarm transmitted by security personnel to the predetermined response indicated in the Safeguards Contingency Plan. Discuss the interrelationships and interdependencies of the transport access detection subsystems and procedures described here with other parts of the in-transit physical protection system, including the Safeguards Contingency Plan. Demonstrate how it will be ensured that detection of unauthorized access to or activities within the transport will allow a response timely and effective enough to prevent the unauthorized penetration or activity from resulting in SSNM theft. Chapter 4 DETECTION OF UNAUTHORIZED ACCESS OR MATERIALS INTRODUCTION BY DECEIT Access detection and control subsystems and procedures for protection against actions of stealth and force were described in Chapter 3 of the Physical Protection Plan (see Chapter 3 of Part I of this guide). They were designed to channel all materials and persons seeking introduction into controlled access areas or transports through established entry control points. The subsystems and procedures described in this chapter are designed to permit the screening of all persons and materials being introduced through such entry control points in order to determine whether they are duly authorized for such access. 4.1 Access Authorizations [Section 73.25(b)(3)(i) and (c)(1)(i)]Intent Access authorizations should be maintained and used with access control systems for controlled access areas and transports. Their purpose is to determine the persons who are authorized to be admitted to the controlled access area or transport and the criteria for their admittance. Access authorizations in the form of a written access authorization schedule enable escort personnel to quickly discriminate between those who are to be admitted to the controlled access area or transport at any given time and those who are to be excluded. Such a schedule may also provide information that can be used to verify the identities of those persons seeking access or of those materials, equipment, or vehicles presented for introduction. Access authorizations would normally name the individual to be granted access and provide the criteria (i.e., the time, place, circumstances, etc.) for admittance. The authorizations would be limited to the specific times when and places where the individual has the need to be admitted to the controlled access area or transport to perform his/her job. They may also specify the activities in which the individual would be authorized to engage while enjoying such access. The authorizations would normally be provided in written form and made available to the escort force personnel who would be responsible for implementing the access control system. In some situations, the security organization may authorize an individual access to controlled access areas or the transport on a temporary basis without specifying the individual's name or means of personal identification. This may be necessary to facilitate refueling or vehicle service at stops. Such individuals would normally be given escorts or placed under close surveillance to ensure that they perform only the tasks for which they have been specifically authorized. These provisions also apply to materials being introduced into controlled access areas or transports. Security-significant equipment, materials, or vehicles that may potentially have an adverse impact on the security of the shipment or that may be used to conceal such equipment or materials may be excluded unless specifically authorized for introduction into a controlled access area or transport. It is the licensee's responsibility to determine which individuals, materials, equipment, or vehicles should be given authorizations and to instruct accordingly the members of the escort force having responsibility for implementing the access control system. Content Describe the criteria to be used for determining which persons and materials are to be approved for authorization for access to or introduction into (1) controlled access areas and (2) transports. Categorize the criteria according to the different situations and conditions expected to apply at different times during shipment. Indicate in which cases persons granted access will require escorts or close surveillance by duly authorized personnel. Describe or refer to the escort or surveillance procedures used to the extent they are applicable. State which individuals in the security organization (position titles and names of individuals) may approve access authorizations. Describe procedures for processing authorizations and the forms used for documenting such authorizations (e.g., authorization lists, letters of authorization). Describe precautions taken to ensure that authorization documents will not be generated without the approval of the responsible individuals in security organization management and to ensure that they will be secured to prevent tampering or alteration. Describe procedures for ensuring that authorization lists will be constantly updated, as necessary, and that only the most current authorization lists will be used. 4.2 Access Control at Entry Control Points [Section 73.25(b)(3)(ii) and (c)(1)(ii)]4.2.1Identification and Verification Intent Access control subsystems and procedures must be implemented, under these provisions, to ensure that only authorized persons and materials are allowed access to or introduction into controlled access areas or transports. Usually these subsystems and procedures will include establishing entry control points, identifying authorized persons or materials, verifying such identifications, and assessing verified identifications against established authorization schedules. Entry control points should normally be few in number (generally not more than one per controlled access area) to ensure the greatest amount of control with the limited personnel and other physical protection resources available. Their objective is to cause each individual seeking entry to the area or transport to be channelled through a screening process for identification, verification, and authorization assessment before being allowed to enter. It is desirable to ensure that the detection of any attempted introduction of unauthorized persons or materials into controlled access areas or transports will be communicated to other escort force personnel so that appropriate measures described in the Safeguards Contingency Plan may be initiated to deny such unauthorized entries. Generally this might best be accomplished by routinely detaining persons attempting entry at the entry control point. Thus the communication of detections of unauthorized persons or materials being introduced can be accomplished before notifying the individual that he will not be admitted for lack of proper identification or authorization. This will provide as much warning as possible to other members of the security organization if the persons involved are in fact adversaries and are prepared to take violent measures upon failure of their deceit mode. One method that will usually accomplish the identification verification function is the use of a numbered picture badge identification procedure affecting all individuals who will have custody of the shipment. This procedure is described in Section 73.26(g)(1) of the reference system. All members of the licensee's escort force and all members of other groups of security personnel authorized to assume custody of the shipment at transfer points or at the final destination are included. Badges held by the persons who would assume custody would be compared with facsimiles of such badges provided in advance to the escort force giving up custody of the shipment to ensure that identifications are valid. Other means may be employed to identify personnel who would be granted temporary access to an area or to the transport. Temporary badges, for example, may be issued to such persons while they are in the subject area or transport. These would signify their temporary status and, if applicable, their need for an escort or other close supervision to limit their opportunities to perform unauthorized acts. Content Describe how entry control points are to be established for controlled access areas of the types described in Section 3.1 of the Physical Protection Plan (see Section 3.1 of Part I of this guide). Also describe the entry control points for each of the transports described in Section 3.3 of the plan (see Section 3.3 of Part I of this guide). For each distinct type of entry control point described above, describe the subsystems and procedures used to detain persons or materials for which introduction is being sought until their identities and authorizations can be confirmed. Discuss measures that would be taken if an attempt is detected to gain entry to introduce unauthorized vehicles or materials through authorized entry control points by deceit. Refer to the Safeguards Contingency Plan as necessary. Describe how identification and documents presented for the purpose of identification will be verified as being authentic. 4.2.2Assessment Against Authorizations Intent After a person's identity has been verified, such identifications must be assessed against a written authorization schedule. This assessment will determine that the person seeking entry has been authorized to enter the controlled access area or transport and that the specific entry criteria described in the authorization schedule have been met. The use of entry criteria is intended to ensure that access is permitted only to allow non-escort personnel to perform specific assigned duties that require access to the controlled access area or the transport. Further, the specification of certain entry criteria makes it more difficult for a potential adversary to gain access by deceit by decreasing the amount of time and the number of occasions on which adversaries could deceitfully obtain such access. Specification of conditions that must be met for the introduction of materials places similar limitations on the potential adversary's ability to successfully introduce unauthorized materials into controlled access areas or transports by deceit. Measures must also be taken to ensure that authorization schedules and other related access authorization items are maintained in a secure manner to ensure their continued availability and to prevent compromise of the authorization assessment subsystems and procedures. Content Describe subsystems and procedures used to assess verified identifications of persons, vehicles, and materials against current authorization schedules and entry criteria (conditions placed upon authorized entry related to particular times, places, and circumstances) before such persons, vehicles, or materials are permitted access or introduction. Describe details of the forms of authorization schedules that will be used by personnel or devices involved in the authorization assessment function. Also discuss the precautions taken to prevent the successful use of counterfeit authorization items. Chapter 5 PREVENTION OF UNAUTHORIZED REMOVAL OF SSNM FROM TRANSPORTS BY DECEIT 5.1 Authorization for Removal of SSNM from Transports [Section 73.25(c)(3)(i)]Intent Authorizations are necessary under the provisions for removal of SSNM from transports at intermediate stopping points and at the final destination. The purpose of such authorizations is to ensure that the SSNM will not be withdrawn unnecessarily or indiscriminately from the transport and placed in a more vulnerable situation as a result of actions of deceit by adversaries. Authorizations for removal of SSNM from a transport are, in effect, instructions to the escort force personnel on times and conditions suitable for removing SSNM from its protected location inside the transport. When persons are presenting themselves as potential recipients of the SSNM, it is especially important to confirm that their identities are the same as those described on the authorization schedule before exposing the SSNM to them by removal from the transport. SSNM will have to be authorized for removal from transports at some transfer points and at the final destination. Numerous scheduled removals from the transport are discouraged and can usually be avoided by use of appropriate equipment and planning. In a shipment involving road, rail, and sea segments, for example, removals of wieldable packages of SSNM from one transport for loading into another can be avoided by using a standardized shipping container of the type specified in the reference system [paragraph 73.26(1)(1)]. To ensure that SSNM is removed from transports only when necessary, authorization schedules for the removal of SSNM from transports must specify authorized times, places, and conditions for removal, plus names of persons authorized to remove and to receive the SSNM. They must also be consistent with the means used to identify the recipients and the controls and procedures for removal. (See Regulatory Guide 5.57, "Shipping and Receiving Control of Special Nuclear Material.")Content Describe the criteria for removal of SSNM from the transport. State the names or position titles of persons who will be authorized to implement removal procedures, as necessary. Describe the SSNM removal authorization schedules that will be maintained to determine when prescheduled removals are to be executed. Also describe the forms of documentation (e.g., hand-to-hand receipts as suggested in the reference system, paragraph 73.26(b)(4)) that will be used to provide a permanent record of transfer of the SSNM when custody of the SSNM is transferred. Samples of authorization schedules and other documentation should be provided. 5.2 SSNM Removal Controls [Section 73.25(c)(3)(ii) and (c)(3)(iii)]Intent Removal controls are necessary to ensure that the SSNM removal authorization schedules just discussed are appropriately implemented and that the security of the SSNM during the removal and subsequent transfer operations is adequately maintained. This is to ensure that the actual SSNM removal is undertaken only after authorization for such removal has been confirmed and the identities of persons into whose hands the SSNM is to be transferred have been verified and assessed against the current authorization schedule. In this sense, the removal controls are a type of filtering process similar to access controls in discriminating between those who are authorized to receive SSNM and those who are not. Removal controls also include verifying the identity and integrity of the SSNM to be removed and ensuring that the removal and transfer of SSNM from the transport is properly documented in order to establish proof that responsibility for the shipment has been duly transferred to the appropriate party. (Hand-to-hand receipts are suggested in the reference system in paragraph 73.26(b)(4). See Section 1.6, "Security Records," of Part I of this guide.) This documentation will ensure the traceability of the shipment if it is missing or overdue at its final destination. Content 1. Emergency Removal Procedures. Indicate that procedures are described in the Safeguards Contingency Plan for the removal of SSNM from the transport in emergency situations for each transport mode involved and that such procedures include how the SSNM is to be protected while outside an approved transport, what procedures are to be followed in transferring material to a substitute transport, and how the escort force would maintain control over the SSNM if a substitute transport were used. Refer to the appropriate portions of the Safeguards Contingency Plan. 2. Prescheduled Removal Procedures. Describe procedures to be used during prescheduled removals of SSNM from transports. Include procedures for identifying persons physically removing the SSNM and those who will be receiving the material (if custody of the material is being transferred). Also include procedures for verifying the identifications of such persons, verifying the identity and integrity of the SSNM that will be removed from the transports, and assessing each of the verified identifications just described against the most current authorization schedules. Describe the procedures to ensure that all the foregoing procedures will be completed satisfactorily before physical removal of SSNM from the transports. Describe the forms for acknowledging receipt of SSNM at all points where there is a transfer of custody of the material. Describe the procedure or devices for validating the receipt of the material (e.g., signature of responsible individual accepting custody, use of corporate seal). Chapter 6 DETECTION OF UNAUTHORIZED REMOVAL OF SSNM FROM TRANSPORTS BY STEALTH OR FORCE 6.1 Transport Features to Delay Removal [Section 73.25(c)(4)(i)]Intent The delay that may be encountered by a potential adversary attempting the unauthorized removal of SSNM from a transport by stealth or force is a significant factor to be considered in the overall design of a physical protection system for SSNM in transit. Transport features that delay removal of the SSNM must be considered, whether they have been specifically designed into a special purpose transport vehicle or are coincidentally present in a multipurpose transport selected to transport SSNM but also relied on to delay unauthorized removal of SSNM. This provision has been included to ensure the use, where feasible, of design features in specially designed transports to increase the delay that would be encountered by an adversary attempting unauthorized penetration of the transport by stealth or force. Where specially designed transports are not feasible, these provisions would permit the physical protection system to be given credit for the transport features that promote such delay found in multipurpose transports. Some features that delay unauthorized removal of SSNM from a transport may be identical to those that prevent or delay unauthorized access to the transport. Those features have been described previously in Section 3.3 of Part I of this guide. This section addresses only the aspects of those features that promote delay in SSNM removal from the transport. A number of fairly simple features may be used to cause delay in unauthorized SSNM-removal attempts. These include fastening SSNM containers to the floor or other part of the transport interior, binding the containers together so that the resulting bulk is too heavy or too large to be moved out of the transport cargo compartment entry point in one action, or filling the cargo compartment of the transport with tear gas or other chemicals designed to obscure vision or otherwise make removal more difficult. However, it is important that the mechanisms used to cause such emissions be designed to prevent unintended accidental triggering of the devices. In the case of road shipments particularly, there is an additional device that would be included under the heading of delaying removal of SSNM, but this involves removal of the entire transport rather than removal of SSNM from the transport. In the reference system, it is suggested as one of two options that the transport vehicle for road shipments be equipped with a device for immobilizing the transport or at least the cargo-carrying portion of the transport so that a potential adversary could not use the transport to depart with the shipment after attack [paragraph 73.26(i)(3)(i)]. This device is designed to delay the adversary from quickly leaving the attack scene with the SSNM before LLEAs arrive on the scene. This device should be sufficiently effective to prevent mobility from being restored to the transport by the adversary in a short period of time, thus defeating the purpose of the immobilization device. Use of a cargo vehicle that does not have this feature would suggest the need for a compensatory increase in other forms of protection such as the use of an additional escort vehicle (as suggested in the reference system). Content Describe the transport features that will be relied on to delay attempts at unauthorized removal of SSNM from the transport. Include details of construction or arrangements made to produce the delay and an estimate of the time and resources required to overcome the obstacle or mechanism causing the delay. Refer to the descriptions of transport features delaying access in Section 3.3 of the Physical Protection Plan (see Section 3.3 of Part I of this guide) as necessary. Describe any transport features that will be relied on to delay removal of a road transport vehicle loaded with SSNM. Include details of construction and operation of any mechanisms designed to immobilize the vehicle and the actions or conditions required to trigger the applicable mechanisms (e.g., improper operation of the vehicle by unauthorized persons, remote-controlled radio signal activation). Include details of the extent to which the vehicle can be restored to normal operating condition following immobilization and the time, resources, and knowledge required to restore the vehicle to normal operating condition. Describe the fail-safe features that ensure that the trigger mechanism for the immobilization device does not become accidentally activated during shipment progress. 6.2 Detection of SSNM Removal Attempts [Section 73.25(c)(4)(ii)]Intent This provision is intended to provide a warning to the security organization that an attempt at unauthorized removal of SSNM from the transport is in progress or is imminent in order to enable a response that will prevent ultimate theft of SSNM. There is a degree of redundancy between subsystems and procedures designed to detect attempts at unauthorized access to transports and those designed to detect attempts at unauthorized removal of SSNM from transports. However, these two categories of detection subsystems and procedures need not be identical. Detection subsystems and procedures not apparent to the potential adversary until penetration is complete are less easily compromised than those apparent from outside the transport. Also, whereas the physical protection system may rely on personnel to conduct surveillance of the transport to detect unauthorized penetration attempts, the detection of unauthorized removal attempts may rely on a mechanical device that cannot be compromised by those conducting the surveillance. This provides some degree of protection against both acts of coercion against the escorts conducting surveillance, as well as acts of collusion by the escort force members. Therefore, it would be desirable that there be some degree of independence between the detection subsystems and procedures designed to detect penetrations and removals. If escort personnel responsible for monitoring access to the controlled access area surrounding a transport are also assigned responsibility for responding to detections of unauthorized penetrations of the transport, an adversary might successfully neutralize such escort personnel and gain access to the SSNM without the LLEAs having been notified. Greater effectiveness may be achieved in the physical protection system by arranging for separate detection subsystems for the controlled access areas and for the transport. Alarms could be annunciated at a remote location occupied by a portion of the escort force. Because the act of unauthorized removal is so close to the realization of a successful theft, annunciations of the alarm could be considered ample cause for contacting and alerting the LLEAs before further action is taken by the escort force to assess the cause of the alarm. This detection system should be consistent with the Safeguards Contingency Plan and Sections 7.2 and 7.3 of the Physical Protection Plan (see Sections 7.2 and 7.3 of Part I of this guide) to ensure that the entire system will be able to detect, assess, and communicate attempts at unauthorized removal so that the response to the attempt can be such as to prevent the theft of SSNM as required in the statement of the required capability. Content Describe the detection subsystems and procedures to detect, assess, and communicate any attempts at unauthorized removal of SSNM from transports. Indicate the times when such systems would be in operation, especially with regard to periods during which other detection subsystems and procedures would be or would not be in operation to detect attempted unauthorized penetration of the transport. Discuss the extent to which the detection subsystems and procedures designed to detect unauthorized removal of SSNM from transports and unauthorized penetration into transports operate independently and offer a degree of redundancy to the detection function in relationship to the transport. Discuss the effectiveness of the subsystems and procedures designed to detect unauthorized removal of SSNM from transports and their interrelationships and interdependencies with other parts of the physical protection system described in the Physical Protection Plan and in the Safeguards Contingency Plan. This discussion of interrelationships and interdependencies should demonstrate that unauthorized attempts at removal of SSNM from transports will be detected. Chapter 7 TRANSMISSION OF DETECTION, ASSESSMENT, AND OTHER SECURITY-RELATED INFORMATION Various requirements for communications capabilities have been described in other portions of this Standard Format (i.e., Chapters 2, 3, 5, and 6 of Part I). The provisions for communications capabilities in this chapter are intended to support the other capabilities where communications capabilities are needed. 7.1 Communications Among Escort Force Personnel [Section 73.25(d)(2)(i)]Intent Communications are routinely required among members of the escort force at different locations, especially in the cases of road transportation where escort force personnel are dispersed among several escort vehicles or where some may purposely be sent to a remote location to ensure a response in the case of attack (see Section 1.8 of Part I of this guide). In addition, communications may be required among escort personnel while some or all of them are on foot, should this become necessary as a result of, or as a tactic in, certain response actions. Thus, communications among escort force members, independent of vehicle-mounted equipment, should normally be provided in some measure. In all cases, for any transportation modes contemplated in the plan, communications subsystems and procedures should be designed to permit proper implementation of the escort force duties and procedures detailed in the Physical Protection Plan and the Safeguards Contingency Plan. Continuous two-way intraconvoy communications are specified in the reference system in the case of road shipments [paragraph 73.26(i)(6)]. Communications among escort force members may be affected by atmospheric conditions, topographic features, and spurious or purposely generated electro-magnetic radiation that may interfere with the ability to communicate clearly. The licensee should select subsystems and procedures to cope with such anticipated difficulties. Communications codes or other devices to disguise position or other security-significant information transmitted among escort force members may also be desirable. Content Describe the communications subsystems and procedures that will be employed to allow communications among members of the escort force, and relate their performance characteristics to the way they are expected to be used at different times during the shipment. Include range and limitations of the equipment, the extent to which the equipment is portable (e.g., portability by an individual in the field, restriction to vehicle mounting, or longevity of power source under continuous use), and procedures for disguising position data and other security information that may be of interest to the potential adversary (i.e., duress codes). Refer as necessary to other parts of the Physical Protection Plan or to the Safeguards Contingency Plan. 7.2 Communications Between the Escort Commander and the Movement Control Center [Section 73.25(d)(2)(ii)]Intent Two-way communications are required between the escort commander and the movement control center to transmit assessment information and requests for assistance from LLEAs. Equipment for such communications may be vehicle mounted but should provide for dead areas and other anticipated conditions that may affect communications from time to time. Segments of the route that present particular communications problems should be taken into consideration. Appropriate measures should be taken to ensure sufficient communications capability to support the objectives of the physical protection system. Although communications are not required on a continuous basis between the escort commander and the movement control center, even in the case of road shipments, a capability for such communications must be provided to allow either direct or indirect communication between the escort commander and the movement control center should an emergency arise and assistance from LLEAs be required. Alternatively, direct communications with the LLEAs would be acceptable in some situations when communications with the movement control center cannot be sustained. The reference system provides that two of the vehicles used in road transportation be equipped with radiotelephones for communication with the movement control center and that there be some other redundant means of communication as well [paragraph 73.26(i)(6)]. For sea shipments, ship-to-shore communications are specified in the reference system [paragraph 73.26(1)(7)], whereas reference system provisions for air and rail shipments do not specify the type of communications system to be used. Content Describe the communications subsystems and procedures that will be used for two-way communications between the escort commander and the movement control center to rapidly and accurately transmit assessment information and requests for assistance by LLEA forces and to coordinate such assistance with the actions of the escort force. Include the range and limitations of the equipment, whether local relays will be required, and the means to be employed for disguising position data and other information in the communications that may be useful to the potential adversary. Regulatory Guide 5.32, "Communication with Transport Vehicles," provides information on radiotelephones and systems and procedures for disguising position data, which would be most useful for road or rail shipments. 7.3 Notification of LLEAs [Section 73.25(d)(2)(iii)]Intent Both the armed escorts and the movement control center personnel under this provision must be provided with the communications equipment and appropriate procedures to allow them to notify the LLEAs of the need for assistance. The reference system suggests specifically a need for redundancy in these communications in certain instances, as discussed in Section 1.8 of this plan. The need for such redundancy underscores the basic philosophy of the licensee physical protection system. The escort force is not intended to be able to defeat potential attackers in an aggressive mode but to protect the SSNM shipment and themselves from harm, while delaying the theft of SSNM or radiological sabotage, until LLEAs arrive. In a system designed to interface closely with LLEA forces, the ability of escorts and the movement control center to communicate with such forces is very important and therefore requires an appropriate level of redundancy. Although the need to maintain a capability for communications with the LLEAs applies to all transportation modes, this does not necessarily mean direct communications. Various types of relays would be possible, especially where redundant modes are concerned. An illustration of how this communications capability can be ensured during transfer operations when the SSNM is probably in its most vulnerable condition is provided in the reference system, which provides that the escort force would split up into two groups made up of two escorts and five escorts during transfers. The two escorts would go to a remote location, and both the two remotely located escorts and the five who remain to protect the shipment would be able to communicate directly with the LLEAs [paragraph 73.26(f)(2)]. However, there are no further specific provisions for communications with the LLEAs in the reference system. Content Describe the communications subsystems and procedures for (1) the armed escorts and (2) movement control center personnel to notify LLEAs of the need for assistance. Refer, if desired, to Sections 7.1 and 7.2 of the Physical Protection Plan (see Sections 7.1 and 7.2 of Part I of this guide). Include in the description the range and limitations (e.g., dead areas for radio communications) of the communications, whether local relays will be required, and whether the escort force will have direct control of the communications system or will share the communications facilities with other persons (e.g., ship's radio on oceangoing vessel, aircraft radio normally used by aircraft crew). PART II PHYSICAL PROTECTION ARRANGEMENTS FOR SPECIFIC SHIPMENTS 1. GENERAL INFORMATION Intent It is provided in paragraph 73.26(b) of 10 CFR Part 73 that security arrangements for each shipment of SSNM be approved by the Nuclear Regulatory Commission prior to the time for the 7-day notice required for shipments by Section 73.72. The purpose of this provision is to permit the NRC to review the shipment physical protection arrangements for a specific shipment to ensure that they provide the level of protection required by Sections 73.20 and 73.25 in the full context of the conditions and situations existing shortly before the time of shipment. Although there is no requirement as to how soon before the shipment this information is to be submitted, it is normally assumed that it would not be so far in advance that the licensee would have to make drastic updating revisions to the submittal just before the actual shipment. The availability of scheduling information from carriers and other sources would affect the date of submittal and would discourage submittal too long before the shipment date. Significant changes in the arrangements reported to NRC should be submitted immediately to NRC as amendments to the original submittal when such changes appear necessary. These amendments will then be approved if extensive review is not indicated. The provisions of paragraph 73.26(b)(3) of 10 CFR Part 73 define basically the types of information to be submitted for each shipment. However, a degree of flexibility is allowed in the amount of information that would be submitted. The licensee may choose to provide as much information as possible in the Physical Protection Plan so that the submittal for each specific shipment would be as little burdensome as possible. Providing details in the Physical Protection Plan, then simply referencing them in the submittal for each shipment would reduce the burden. On the other end of the spectrum, the licensee may choose to include in the submittal for a particular shipment a number of departures from the Physical Protection Plan, perhaps made necessary by temporary conditions beyond his control. This provision would be most suitable for temporary changes effective for only one shipment. There are also provisions for updating the Physical Protection Plan as well. The licensee, at his discretion, may choose to widely distribute the details of the physical protection arrangements for a particular shipment between the Physical Protection Plan and the submittal of Physical Protection Arrangements for Specific Shipments with the understanding that both together describe the physical protection system for any particular shipment. It is advantageous to keep the volume of any such submittals to a level commensurate with the time allowed for NRC review. The sections that follow provide a standard format for the different types of information that may be submitted before a particular shipment. The physical specifications for such submittals are the same as for the Physical Protection Plan, as described in the Introduction to this Standard Format. Content State the purpose of this submittal as supplying the NRC certain information on specific security arrangements for shipments of SSNM in formula quantities sufficiently in advance of the shipment to allow NRC approval of such arrangements before the time for the 7-day notice required by Section 73.72 of 10 CFR Part 73. Reference the Physical Protection Plan corresponding to this submittal by docket number and date. 2. ITINERARY INFORMATION Content State the estimated dates and times of departure and arrival, the names of the shipper, receiver, and carrier(s); and the mode(s) of shipment. Describe the route to be used for the proposed shipment by referring to the appropriate section in the Physical Protection Plan, indicating any differences in the itinerary compared to that described in the Physical Protection Plan. Provide the appropriate information corresponding to such differences as required in the Physical Protection Plan so as to completely update the itinerary information required for the proposed route. Note such changes and include them as an appendix to this submittal. 3. TRANSFERS OF SHIPMENT SECURITY RESPONSIBILITY Content Note by reference to the stated itinerary the times and locations of points where there will be transfers of responsibility for the security of the shipment (i.e., escorts either accepting or relinquishing responsibility). At each such point, describe the arrangements made to continuously maintain the security of the shipment during the transfer, including points at which the escorts will accept responsibility for an import shipment. Refer to the Physical Protection Plan as necessary. 4. DIFFERENCES FROM THE PHYSICAL PROTECTION PLAN Content Describe any subsystems or procedures to be used for the particular shipment described here that differ significantly from those described in the Physical Protection Plan. Present this information sequentially, according to the headings that apply to the subsystem or procedure to be supplanted. In the case of each difference from the Physical Protection Plan, indicate why the change is being made. 5. RELATIONSHIP TO THE PHYSICAL PROTECTION PLAN Content Ensure that, except as specifically noted in this submittal, all subsystems and procedures for the physical protection of the proposed shipment described here will be substantially the same as those described in the Physical Protection Plan. 12 |