Publication Date: 2/1/81     Pages: 6     Date Entered: 1/5/93     Title: Reporting of Physical Security Events     February 1981     U.S. NUCLEAR REGULATORY COMMISSION     REGULATORY GUIDE     OFFICE OF STANDARDS DEVELOPMENT     REGULATORY GUIDE 5.62     (Task SG 901-4) REPORTING OF PHYSICAL SECURITY EVENTS A. INTRODUCTION     Paragraph 73.71(c) of 10 CFR Part 73, "Physical Protection of     Plants and Materials," requires that licensees report to appropriate     offices within the Nuclear Regulatory Commission events that     significantly threaten or lessen the effectiveness of their physical     security systems as established by safeguards regulations or an approved     safeguards plan or both. As required by 10 CFR Part 50, "Domestic     Licensing of Production and Utilization Facilities," and 10 CFR Part 70,     "Domestic Licensing of Special Nuclear Material," a safeguards plan must     include one or more of the following plans: physical security,     contingency, and security personnel qualification and training.     This regulatory guide provides an approach acceptable to the NRC     staff for determining whether an event should be reported and the time     frame during which the event should be reported and suggests a format     that could be used for reporting the event. B. DISCUSSION     Events of concern may be divided into two categories: (1)     threat-related events, i.e., those that pose a possible threat to a     facility or to a shipment, or (2)     loss-of-physical-security-effectiveness events, i.e., those in which the     physical security system has failed or has been compromised or degraded.     In each of the categories, the reporting routine will vary, depending on     the severity of the event. The event categories and the associated     reporting routines are included in Table 1 of the regulatory position.     Threats     Explicit threats are those events in which information has come to     the attention of a member of the licensee's security organization or any     other employee of the licensee that an act of theft or radiological     sabotage will be attempted.     Potential threats are those in which information has come to the     attention of a member of the licensee's security organization or any     other employee of the licensee that supports a belief that an act of     theft or radiological sabotage may be attempted.     Some judgment has to be exercised about when to report potential     threats. A licensee should report a potential threat as soon as it     becomes evident that the threat is serious even though a report is not     required until 24 hours after information of the potential threat is     received.     In some cases, explicit and potential threats have been addressed     in the licensee's contingency plans. If they have been addressed and if     the contingency plan procedure requires the event to be reported, the     licensee should report the event. However, if after following the     procedures of the contingency plan for the event it is determined that     the event is not reportable, a report need not be made. Typical events     and the respective reporting times are included in the regulatory     position of this guide.     Loss of Physical Security Effectiveness     A major loss of physical security effectiveness (see footnote 2 to     paragraph 73.71(c) of 10 CFR Part 73) occurs under any one of the     following general conditions and should be reported within the time     frame specified: 1. The breakdown of security systems designed or employed to     prevent an unauthorized individual from entering a vital or material     access area (see paragraphs 73.2(h) and (j) of 10 CFR Part 73) is such     that access could have been gained without detection. The reason for     reporting this event within an hour is that the vital and material     access areas are the ultimate target for theft or radiological sabotage     and, since the last line of defense to them has been completely     degraded, the physical security system has no protection against an     insider. 2. All communication systems used to summon local law     enforcement response forces become inoperative. (The Emergency     Notification System to the NRC is not considered a communication system     used to summon local law enforcement response forces.) The reason for     reporting this event within an hour is that the ability to directly     summon offsite response forces has been completely eliminated. 3. Improper personnel procedures occur that lead to conditions     in which unauthorized or undetected access to vital or material access     areas, to a shipment of formula quantities (see paragraph 73.2(aa) of 10     CFR Part 73) of strategic special nuclear material, or to a shipment of     irradiated reactor fuel is possible or the ability to summon response is     not available. The effect of procedure violations that result in this     condition is the same as that in the previous two conditions; hence, the     event must be reported within an hour.     Any condition that constitutes a major     loss-of-physical-security-effectiveness event that has been properly     compensated(1) for in a timely manner is considered to be a moderate     event and does not have to be reported within an hour but must be     reported within 24 hours. The delay in reporting is allowed because the     physical security effectiveness has essentially been restored to the     required level and the possibility for compromise of the physical     protection system in the interim was minimal. A report, however, has to     be made within 24 hours because of the potential severity of the event     and because the NRC needs to be informed of the causes of such events     and the actions taken to correct them.     In contrast to licensees who have to meet the requirements of     Section 73.20, 73.37, 73.50, and 73.55 of 10 CFR Part 73, licensees who     possess, store, transport, or use only special nuclear material of     moderate strategic significance or special nuclear material of low     strategic significance (see Section 73.67 of 10 CFR Part 73) are not     subject to the requirements for reporting major     loss-of-physical-security-effectiveness events.     A moderate loss of physical security effectiveness (see footnote 5     to paragraph 73.71(c) of 10 CFR Part 73) for a physical security system     occurs under any one of the following conditions and should be reported     to the NRC within 24 hours after discovery: 1. Any one of the conditions listed under a major loss of     physical security effectiveness that has been properly compensated(1)     for in a timely manner. 2. In the following two conditions, the protected area is     considered one of the redundant systems for protection of the vital or     material access areas. However, unlike vital area and material access     area systems, a breakdown of the protected area security system does not     leave the material access or vital area without protection. Therefore,     this type event does not have to be reported as soon.     ----------     (1) "Properly compensated [for event]" is defined in footnote 4 to     paragraph 73.71(c) of 10 CFR Part 73 as measures specified in a security     or contingency plan that provide a level of security equivalent to that     existing before the event, or, if the event is not specified in either     of these plans, it means measures implemented within 10 minutes of an     event's occurrence that provide a level of security equivalent to that     existing before the event.     ----------     a. The breakdown of security systems designed or employed to     prevent an unauthorized individual from entering protected or controlled     access areas (see paragraph 73.2(z) of 10 CFR Part 73) is such that     access could have been gained without detection.     b. Improper personnel procedures occur that lead to the     condition in which unauthorized access to protected or controlled access     areas or to a shipment of special nuclear material of moderate strategic     significance (see paragraph 73.2(x) of 10 CFR Part 73) is possible or     the ability to summon response is not available. 3. Loss of any one redundant or diverse vital or material     access area security system leaves these areas under the protection of     only one security system. This includes loss of either the central or     secondary alarm station. Although the protection afforded the vital and     material access areas has been degraded through the loss of one     redundant or diverse system protecting it, a complete loss of protection     has not occurred, and the event therefore does not have to be reported     as soon.     If conditions listed in 2 and 3 under the moderate loss of     physical security effectiveness result in a moderate event and that     event has been properly compensated(1) for in a timely manner, it does     not have to be reported to NRC; however, the event does have to be     recorded in the licensee's records. C. REGULATORY POSITION     Licensees should evaluate physical-security-related events in     accordance with Section 73.71(c) of 10 CFR Part 73 and the guidelines in     the discussion of this guide to determine whether they are reportable.     If after application of Table 1 and the guidelines it is determined that     the event needs to be reported or, if any doubt exists about whether the     event should be reported, it should be reported by telephone to the     Director of the appropriate NRC Inspection and Enforcement Regional     Office listed in Appendix A to 10 CFR Part 73.     The telephone report should include, as a minimum, the information     requested in the appendix to this guide. The written report should     include, as a minimum, the information requested in the appendix to this     guide as well as any additional information that the licensee is     requested to furnish the NRC. Written information requested in the     appendix should be supplemented, as needed, by additional narrative     material to provide a complete explanation of the circumstances     surrounding the event. Threat-related events affecting plants under     construction should be reported under paragraph 73.71(c) of 10 CFR Part     73 only if the plant under construction has a license, i.e., the plant     is licensed to have fuel on site. It is not expected that events     involving loss of physical security effectiveness would occur for plants     under construction. However, defects or deficiencies in security     equipment or its installation are reportable either under 10 CFR Part 21     or paragraph 50.55(e) of 10 CFR Part 50.     Threat-Related and Physical-Security-Effectiveness Events     Time frames for reporting the various categories of threat-related     and physical-security-effectiveness events are shown in Table 1.     (Due to database constraints, Table 1 is not included. Please contact     LIS to obtain a copy.) Some events that have been identified as reportable by the NRC     staff after application of the procedures of this guide are listed     below. 1. Events to be reported within 1 hour after a member of the     licensee's security organization or any other employee of the licensee     becomes aware of the event include the following:     a. Attempted or confirmed intrusions at vital material     access, protected, or controlled access areas.     b. Attempted intrusions into protected area by protesting     groups.     c. Discovery of or attempted introduction of unauthorized     weapons, explosives, or incendiary devices inside the protected or     controlled access areas.(2) d. Bomb threats or extortion threats.(2) e. Mass demonstrations, picketing, or other job actions     at the plant site.(2) f. Civil disturbances near the plant site.(2)----------     (2) These events should be evaluated and reported in accordance     with contingency plans. If the threat is more potential in character     than explicit, it can be reported within 24 hours from the time it has     been estimated to be in existence.     ----------     g. Loss of both central and secondary alarm stations.(3) h. Loss of all capability for offsite communication to     the local law enforcement agency.(3) i. Loss or degradation of power for the physical security     system below that level required to keep the security system operating     at rated capacity.(3) j. Failure or loss of operability of any alarm or     intrusion detection system or portion thereof that could be directly     exploited to allow undetected access to vital or material access areas     such as (1) card reader access control system malfunction so that     unauthorized personnel could gain access to vital areas or (2)     simultaneous failure of vital or material access area intrusion     detection and threat assessment equipment.(3) k. Unavailability of minimum number of security     personnel.(3) 2. Events to be reported within 24 hours after a member of the     licensee's security organization or any other employee of the licensee     is made aware of their occurrence include the following:     a. Theft of security weapon at the site.     b. Confirmed tampering with security equipment.     c. Discovery of spurious identification badges, key     cards, or security locks and keys.     d. Theft of documents containing proprietary or     classified security information.     e. Unexplained fire or explosion within the isolation     zone, protected area, or controlled access area that could affect plant     security.     f. Sudden retirement, discharge, or resignation of key     security personnel if the event results in a moderate loss of physical     security effectiveness.(4) g. Security-related injury to a member of the security     organization such as that caused by malfunctioning security equipment.     h. Sickouts or other labor problems affecting the     readiness of the security forces.     i. Any event that reduces the capability for offsite     communication to the local law enforcement agencies. (This would not     include loss of service of any one regular telephone, even from an alarm     station. However, it would include loss or malfunction of an alarm     station radio or hotline equipment.)(4)----------     (3) These events do not have to be reported within one hour if     properly compensated for in a timely manner; however, they have to be     reported within 24 hours.     (4) These events do not have to be reported if properly     compensated for in a timely manner; however, they do have to be recorded     in the licensee's records.     ----------     j. Failure or loss of operability of any alarm or     intrusion detection system or portion thereof that could be directly     exploited to allow undetected access to the protected area such as (1)     simultaneous failure of any one perimeter intrusion alarm segment and     threat assessment equipment or (2) undetected failure of any one     perimeter intrusion alarm segment.(4) k. Failure of perimeter lighting to an extent that would     impair threat assessment.(4) l. Loss of either the central or secondary alarm     station.(4) m. Number of guards at transfer points of a shipment     fewer than that required by the regulation or security plan.(4) n. Unexplainable security situations impeding the     effectiveness of security to the limit defined in the physical security     plan.     Classification and Transmittal of Sensitive Information     A report of a physical security event may contain information that     is sensitive; such an event needs to be protected from disclosure.     Sensitive information can be proprietary, classified, or both. The     licensee should review an event to determine whether the information     associated with the event is classified, proprietary, or unclassified.     The determinatiin of whether information is classified should be made by     the licensee after referring to the NRC Classification Guide for     Safeguards Information (Appendix A to 10 CFR Part 95) and other     applicable classification guides issued by other government agencies.     The licensee is responsible for determining what information is     categorized proprietary.     If an event is categorized as proprietary, all the information     regarding the event can be transmitted to the NRC by an unsecured     telephone and by first-class mail.     If an event is categorized as classified, the telephone report to     the NRC should convey only that an event that meets the criteria of     paragraph 73.71(c) of 10 CFR Part 73 has occurred. The written report     should be marked with the appropriate classification markings and     handled accordingly. Section 95.39, "External Transmission of Documents     and Materials," of 10 CFR Part 95 (45 FR 14488, March 5, 1980) contains     the requirements for transmittal of classified documents and material.     (Due to database constraints, the Appendix is not included. Please     contact LIS to obtain a copy.)VALUE/IMPACT STATEMENT(*) The revision to Section 73.71, "Reports of Unaccounted-For     Shipments, Suspected Thefts, Unlawful Diversion, Industrial Sabotage or     Events Which Significantly Threaten or Lessen the Effectiveness of     Safeguards," of 10 CFR Part 73 includes the requirement that licensees     report events that could significantly threaten or lessen the     effectiveness of their physical security systems as established by     regulations or by their NRC-approved physical security, contingency, and     security personnel qualification and training plans.     ----------     (*) The original draft value/impact statement for Draft Guide SG     901-4, published in October 1979, and the value/impact and report     justification analysis prepared for proposed amendments to Part 73,     "Physical Protection of Plants and Materials," of 10 CFR Part 73, which     have been revised to change "safeguards" events to "physical security"     events but otherwise are still valid, are available for inspection at     the NRC Public Document Room, 1717 H Street NW., Washington, D.C.     ----------     As a result, more explicit reporting requirements than presently     exist for certain physical security events are clearly needed. These     explicit reporting requirements, as described in Regulatory Guide 5.62     (Task SG 901-4), include the reporting of events that may not have been     reported in the past under the requirements of 10 CFR Part 21 as leading     to a substantial safety hazard and put NRC into an improved overview     position from the standpoint of maintenance of physical security     effectiveness and reaction to physical security events.     This guide provides guidance for identifying physical security     events that should be reported and recommends the procedures for     reporting them.     15