WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  

Security of Industrial Radiography Sources
A WINS International Best Practice Guide
WHY YOU SHOULD READ THIS GUIDEThe use of radioactive sources to inspect materials for hidden flaws is a valuable commercial assessment
tool. Thousands of these sources are in use at any time all over the world. We know that the loss and theftof these high activity sources are a fairly common occurrence. If they are used maliciously, they have thepotential to significantly harm individuals and the environment. Therefore, their security should be of great
concern to users, regulators and law enforcement officials. This WINS International Best Practice Guide
explains how your organisation can help to reduce the risk of theft of your industrial radiography sourcesand enhance their security worldwide.

About the Appendices
Appendices A and B provide a series of questions and levels of organisational competencies relating to
your organisation’s security of industrial radiography sources that can enable you to see how well yourorganisation is doing and be able to benchmark its performance. Results of this benchmarking process
may indicate possible gaps in your security infrastructure and could provide you with a starting point for
improving the situation.

About the Preparation of the Guide
In preparing this Guide, we have taken note of the real-life experiences of industrial radiographers andsecurity professionals. In particular, this document borrows heavily from two regional workshops onradioactive source security for industrial radiography practices held in Sydney, Australia (September2010)1 and on a series of WINS workshops on the security of high activity radioactivity sources conducted
in 2011 and 2012.
Wherever possible, this Guide uses the same terminology as that found in the International Atomic Energy
Agency (IAEA) Nuclear Security Series2 and Safety Series3 publications.

	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  
1 Report of the South East Asia Regional Workshop on Radioactive Source Security Level B (Industrial Radiography

Practices), Sydney, Australia, 6-10 September 2010
2 Security of Radioactive Sources Implementing Guide, International Atomic Energy Agency Nuclear Security Series No.
11, 2009
3 Safety Guide SSG-11, Radiation Safety in Industrial Radiography (2011).

Page	
  1	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
We Welcome Your Comments
We plan to update the information in this Guide frequently to reflect best practices and new ideas.
Therefore, we ask that you read it carefully and then let us know how it can be improved. If you need help
or assistance with any aspect of this Guide, please email us. You can also contact us via your WINS
membership portal.

ICNDT Contact Information

WINS Contact Information
World Institute for Nuclear Security

The International Committee for NonDestructive Testing

Graben 19

Secretariat: The British Institute of NDT

AT-1010 Vienna

Newton Building, St George's Avenue

Austria

Northampton, NN2 6JB

Email: info@wins.org

United Kingdom

Fax: +43 (0) 1230 606089

Email: icndt@bindt.org

Phone: +43 (0) 1230 606083

Fax: +44 (0) 1604 893861

www.wins.org

Phone: +44 (0) 1604 893811
www.icndt.org

Dr Roger Howsley,

Dr J M Farley,

Executive Director, WINS

Chairman, ICNDTRevision 1.0
December 2012
ISBN: 978-3-903031-58-6

	
  

Page	
  2	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  

WHY YOUR ORGANISATION NEEDS TO PROTECT ITS RADIOACTIVE
SOURCES
Industrial radiography is the use of ionizing radiation to examine objects in a way that can't be seenotherwise. It is a major non-destructive testing (NDT) method used to determine the quality of materials
and welds by using gamma rays and x-rays. The principle is similar to the use of medical x-rays to examine
for broken bones. Gamma rays are emitted from radioactive material and do not need a supply of electrical
power to function and, therefore, particularly adaptable for field operations. However, these sources cancreate considerable health and physical damage and concern if stolen and used in a malicious manner.
Consequently, the overall objective of any security programme should be to minimise the likelihood of theunauthorised removal of radioactive sources and devices from company control. The physical protection
and security management of these industrial radiography sources should be part of a company’s relevant
operational policy or programme, its plans and procedures, and communicated to all staff. Some of thefactors which indicate why this is important are:Material Attractiveness – Industrial radiography sources are attractive targets for individuals withmalicious intention because of their high activity levels, ranging from ten to several hundred Curies (4 toover 50 TBq) of Iridium-192 (Ir-192), Cobalt-60 (Co-60), and Selenium-75 (Se-75). Exposure of anindividual by such unshielded industrial radiography sources can cause considerable harm in a matter ofminutes.
Half-Life – The half-lives of the sources are long enough to persist in the environment to cause harm andpublic concern: 5.3 years for Cobalt-60, 120 days for Selenium-75 and 74 days for Iridium-192.
Prevalence – Industrial radiography is an analytical technique used routinely all over the world in bothurban and remote locations. At any time there are thousands of sources being used or in transit.
Portability – Industrial radiography devices containing radioactive sources are well shielded, small andlightweight: therefore easily mobile.
Locations – Industrial radiography operations are often in remote areas where local law enforcement
authorities may not be readily available.
Past Security Events – There have been a number of cases of industrial radiography devices containing
radioactive sources being stolen or becoming missing worldwide. The actual intent is generally not clear.
However, industrial radiography radioactive sources have been central to a number of historical malicious
plots involving radioactive material. These have included extortion attempts and the use of Iridium-192 aspart of malicious attempts to harm individuals.

Page	
  3	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  

CONSIDERATIONS FOR DEVELOPING A SECURITY PROGRAMMEYour programme for securing radioactive sources should be well thought-out and diligently applied
whenever you employ radioactive sources for industrial radiography operations. Besides concerns about
the storage of this material and the problems in using the sources at temporary job sites, there are alsosignificant vulnerabilities during the frequent transport of these sources between fixed locations andtemporary job sites. The security concepts described in this guide can serve as a primer for developing aneffective set of security measures to prevent theft4.
These concepts, if used properly, can enhance the security of industrial radiography sources at fixedlocations, during transport, and at temporary job sites. They should, to the maximum extent feasible, be
adopted as prudent business practices to secure your radioactive sources against theft and othermalicious acts.
It is recognized that the limited size and resources of NDT companies and the monetary value of theradiography devices may not warrant more than a modest security expenditure, but when one considers
the harm to the reputation of the company and possible cleanup or other mitigation costs if there is anincident, security expenditures may be warranted.

Threat Assessment
If you recognize the security of your radioactive sources is important and may need improvement, it is thenessential to know who your adversaries are and what capabilities they might have in order to determine
how much security is necessary. Such an analysis of the potential threats is usually done by national
authorities. It would be based on an evaluation of terrorist and criminal presence, recent security incidents,
history of nuclear and radiological smuggling, criminality, corruption, etc. The output aims to describe themotivation, intentions and capabilities of credible threats which are an indication of the level of security
needed. If the State has not performed a national threat assessment or defined threats applicable toindustrial radiography sources, you should perform your own threat assessment to identify a baseline ofpotential adversary characteristics and attributes. This can be done with the assistance of security
consultants and/or in coordination with local law enforcement agencies. More detailed information on thisissue can be found in the WINS International Best Practice Guide, Threat Assessment (2010), and in IAEA
Nuclear Security Series publication No. 10, Development, Use and Maintenance of the Design Basis Threat(2009).

Graded Approach
It is recommended that security measures be applied using a graded approach: not spending money andeffort for measures that are not needed. Any security measures to be implemented should take into
account the principles of risk management, including such considerations as the level of threat, therelative attractiveness of the source, and its potential to cause unacceptable consequences to the public
and your organisation.

	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  
4 It is recognized that some of the security measures described may not be permitted by national laws or regulations(e.g., background checks). If any security measure in this guide is unlawful in a particular country, adherence tonational laws and regulations must take precedence.

Page	
  4	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Defence-In-Depth
Another concept to be applied when constructing an effective security system is defence-in-depth. Thisrefers to creating a combination of multiple layers of security measures that have to be overcome tocompromise security. The existence of these layers will require an adversary to avoid or defeat a number ofdifferent security measures in sequence in order to be successful. For example, an adversary might needto penetrate two or more separate barriers before gaining access to a source storage area. Moreover, it
deters the adversary by adding uncertainty, requiring different techniques and tools, and creating
additional steps. A layered defence approach adds to a system's overall reliability by eliminating
dependency on one security measure, creating vital redundancy, which protects against a single point of
failure.

IMPLEMENTING A GOOD SECURITY PROGRAMME
When these initial considerations are understood, the actual design of a security programme can beinitiated. This guide separates the suggested approach into two sets of elements: protective elements
and management measures.
How your programme is actually structured is up to your organisation, but some aspects of these elements
will, of necessity, have to be either explicitly or implicitly addressed in a comprehensive security
programme. They are provided below and then followed by a set of best practices which demonstrate at amore detailed level how they can be implemented operationally.
It is not expected that small or medium sized companies immediately adopt the measures recommended
in this guide. These measures can also be seen as a target for improvement as changes are made tocompany procedures and facilities. Some suggestions, such as enhancing security culture, including
security awareness training can start immediately and with little cost.

PROTECTIVE ELEMENTS
Good security is one of balanced protection: a concept of equivalent security functions that provides
adequate protection against all threats along all possible pathways. Thus the security system shouldincorporate a number of protective elements described below which, when employed correctly, will
establish the web of defences to combat an adversary: Deterrence, Access Control, Detection,
Assessment, Delay and Response. This is not necessarily a sequential list of measures since physicalprotection functions do not always follow such a chronological order: rather a security system is made ofmultiple combinations of these functions.
Deterrence
When implementing a security programme, it is useful to have certain protection elements visible topotential adversaries, e.g. fence, lighting, regular security patrols, signs, and guards properly attired. It is agood tactic to demonstrate a security profile that appears robust, so that an adversary will be reluctant to
attack.

Page	
  5	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Access Control
The objective of access control is to ensure that only appropriate users have access to a facility and toradioactive sources used by your company. There is a wide array of measures that you can apply to help
secure access: procedural, electronic and physical. For example, it can include such measures asvalidating the suitability of an individual, restricting entry of individuals and vehicles to a facility, controllingkeys to storage locations, radiography source devices and containers. Access control should be designed
to minimize the impact on individuals and interference with operations. Access control measures should
also be applied to vehicles and goods entering or leaving your premises.
Detection
Early detection is a key component to help any response force interrupt an adversary. Normally detection
systems are combined with an assessment system since there is no meaningful detection without knowing
what the alarm really means. Facilities are usually designed to limit the number of adversary pathways tothe source storage areas which allows for the effective use of detection and assessment equipment.
Ideally, detection systems should be properly designed and installed to incorporate complementary
technologies so that the adversary must use a variety of defeat methods. Detection systems are also
designed to have a low nuisance and false alarm rate with a high probability of detection and able todetect tampering by the adversary.
Care then would be taken to make the system reliable and robust for the operating environment. Any
system should be maintained and its effectiveness periodically verified through a performance testing
programme.
Assessment
Personnel should be trained to verify the authenticity of an alarm occurrence and be capable of initiating a
response. When affordable, closed circuit television (CCTV) monitoring of selected locations can be aneffective means of alarm assessment. To be considered an assessment tool, CCTV should be available
twenty-four hours a day and monitored at all times.
Assessment should take place in a protected location that is not vulnerable to intruders and assessment
personnel, such as on-site guards or operations personnel, should have a reliable means to summon help
immediately, e.g., duress buttons, radios, etc. It should also be noted that common practice is to save
CCTV recordings for investigative purposes and insider theft deterrence.
Delay
An adversary can be delayed by the use of barriers to provide sufficient time for the assessment of andresponse to criminal or malicious acts. The location of delay elements is important in a physical protection
system.
It is usually less expensive to place barriers closer to the target being protected when trying to protect
against the theft of radioactive sources. When sabotage is the principal concern, delay elements shouldbe placed as far from the target being protected as possible to allow response forces more time tointerrupt the adversary actions.

Page	
  6	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Several different delay barriers are usually applied in the protection of radioactive sources, forcing theadversary to bring a variety of tools to defeat each delay element. Integrating these delays into the facility
design is a help in minimizing the effect they have on safety features. It is also a good idea to takeadvantage of design features associated with the facility. It is very important that sufficient delay isprovided after detection so that response personnel can interrupt the adversary. Delay measures are partof the physical protection system and will not be effective without detection and assessment.
Response
It is important to develop a plan to respond to a security incident along with procedures to define roles andresponsibilities among operator staff and people who would respond (security contractor, law enforcement)
either at the fixed location, during transport or at a temporary job site.
When on-site guards are used, they should be properly equipped and trained and most importantly, theyshould be part of a trustworthiness/reliability programme. Since communications are always a vitalelement of any response, there is a need to have reliable and diverse communications. Then, to assurethat the response plan is appropriate and to validate response force readiness, exercises should be
conducted periodically.

MANAGEMENT ELEMENTS
In addition to these protective elements, the security system needs to integrate people and procedures, aswell as the continuous training of radiographers, the exercise of security measures and the protection of
information and other related management measures.
Procedural Development
The individual responsible for the security of industrial radiography sources should have the neededauthority and accountability to effectively manage the security system, and should revise existingprocedures or develop new ones for the following:ØOperational procedures;Ø

Access control procedures;Ø

Insider protection programme to include human reliability assessments and such other measures
as access control, two-person rule, key and lock controls;Ø

Response plans in coordination with the appropriate authorities;Ø

Conducting periodic tests or exercises to validate response force readiness;ØPreventive maintenance programme for the proper operation of the security equipment;Ø

Performance testing for the security system by the facility staff to support continued effective
operation of the system; andØProcedures for the protection and retention of security-related documents and sensitive
information.

Page	
  7	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Written procedures should describe all the existing security measures and, where necessary, revised toinclude the security responsibilities of staff at the fixed location, temporary job sites, and in transport.
Your company should develop a security plan to describe the overall security measures in place to protect
the radioactive sources. (Guidance on the contents of a security plan is included at the end of this part of
the guide.) Procedures should be developed to implement, test, periodically review and revise that security
plan.
Procedures and arrangements should be established to perform human reliability assessments.
Background checks, reference checks, trustworthiness determinations, etc., are normally implemented asallowed by company polices and national laws. If a check cannot be performed due to legal restrictions orlack of available information, the company should consider these limitations in their actions to mitigate
possible insider threats.
Security Awareness and Training for Staff
You should develop a listing of required security related training topics, and the personnel who should
obtain the identified training. A primary purpose of training should be the development of skills andcompetencies of the staff necessary to meet the requirements of their work and job descriptions. Amongothers, this training could cover the operation of security equipment and the implementation of security
procedures for the protection of radioactive sources (e.g., access control, material surveillance, response
actions).
The security equipment contractor or other specialised companies should provide on-going security training
to radiographers, especially those who take sources to temporary job sites, use them in the field and are
responsible for their security at temporary storage areas when away from the company and a fixed storage
location. It is good practice to conduct periodic security awareness and procedure training along withsafety training.
Consideration should also be given to additional training topics such as human factors impacting security
performance and security culture5, which may be developed in-house or by a qualified third party.
Alarm Monitoring
The intrusion detection system and other alarms should be monitored on-site and, as applicable, by an offsite alarm monitoring station.
The off-site function can be performed by a variety of entities to include commercial central alarm stations,company operations centres, police stations, etc. The intent of the off-site alarm monitoring is to avoid asingle point of failure that depends on on-site personnel to initiate a response.

	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  
5

	
  For	
  further	  discussion	
  of	
  security	
  cultures,	
  see	
  WINS	  International	  Best	  Practice	
  Guide,	  Security	
  Culture.	
  
Page	
  8	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Equipment Performance
A regular performance testing programme, both internally and in conjunction with the security equipment
contractor, is a normal practice to test the effectiveness and reliability of equipment, people, andprocedures.
Maintenance
It is important to develop and implement a security equipment maintenance programme, including
functional testing and preventative actions. Security equipment contractors normally provide warranty,
maintenance, testing, and upgrade services for the equipment installed.
Information Security
Where it is necessary to limit access to security sensitive information to those persons who have a need toknow, specific procedures should be developed. This includes protection of information about the material
and operations, transport timing and routes, and specific information about security measures.
Actions to be taken in Case of Loss or Theft of a Radiography Device
In the event of a loss or theft of a radiography device, it is critical to provide law enforcement authorities
and other relevant organisations with reliable information on the circumstances of the incident and details
about the missing device(s). To facilitate this process, it is suggested that information about your devices
and contained radioactive sources be gathered into a single file and kept securely as both a hard copy andan electronic file. This, for example, should include information enabling the positive identification of theequipment, such as, any wording on the device, size, weight, serial number and pictures of the device.

BEST PRACTICES FOR THE SECURITY OF INDUSTRIAL RADIOGRAPHY
SOURCESThe following set of practices demonstrates at a more detailed level how the physical and management
elements described above could be implemented operationally.

FIXED LOCATIONS (MAIN STORAGE/BUNKER)
ØStore radiography sources in a dedicated storage area.
The walls of the storage area should be of robust design and the number of access points (doors;
windows...) to the area should be minimised and hardened (locks, grids...).

Ø

Store radiography devices in separate locked compartments (e.g., a safe) within the storage area.
Such measure provides an additional layer of protection after access in the storage room. It
prevents a direct and easy access to multiple radiography devices if access control to the storage
room is compromised.

Page	
  9	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Ø

Implement a two-person rule access control system for radiography source storage areas
containing multiple radiography devices.	
  	
  To gain access to the storage area, this access control system requires that two authorized
employees be present and that each employee possesses one key/card/code to open theirassigned delay element. This measure provides an additional layer of defence to background checks
or an evaluation of trustworthiness/reliability and further lessens the risk of an insider committing
theft or diversion of a radiography sources.
In instances where a strict two-person rule cannot be implemented for operational reasons, such asa lack of personnel, the company should institute alternative physical and management elementsthat will mitigate the insider threat, and in particular track who had access to the storage area or to
the safe.

ØStore keys and other access cards into security boxes, such as key safes.	
  	
  Security boxes should be located in protected locations (e.g., rooms with intrusion detection; locked
areas; not accessible by public).

ØTrack the movement of sources in and out of storage.
Movement of sources should be recorded in a readily available log book. Procedures should be
developed to ensure that movement of sources have been authorised.

Ø

Source changers, empty containers and handling tools should be stored and secured separatelyfrom the sources	
   to reduce the likelihood that these items could be used to facilitate the diversion
of a source.	
  Ø

Ensure reliable intrusion detection in the storage.
Install an intrusion detection system in the storage area. The area should be equipped with at least
2 motion detectors and the doors and other openings leading to the source storage location shouldbe equipped with Balanced Magnetic Switches (BMS) or other devices to detect their opening.
Detections should activate a local siren and strobe light to provide an alarm indication in the vicinityof the source storage location. It is common that audible alarms exceed 100 decibels.
When a large number of devices are stored, the intrusion detection alarms should also be reported
to an alarm monitoring station.
The main electrical power source for the intrusion detection system should be supported by an
auxiliary system capable of providing power for at least 48 hours.
Security equipment (intrusion detection system, locks, security doors...) installed in the facility
should comply with industrial security standards.
It is good practice to consider extending the intrusion detection system and other security provisions
to all areas of your facilities where sources can temporarily present a risk.

Page	
  10	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Ø

Provide the staff with means to send an alarm to alert in case of a security incident.
The intent of this measure is to allow personnel accessing the source storage area to summon a
response because the detection system would have been deactivated to allow access.
It is most important to install a duress signal in or near the source storage and equipment loading
areas. Whenever practical, the use of mobile alert devices should be considered.

Ø

For large inventories, new facilities or high threat environments, provide CCTV coverage of source
storage and other locations where sources can temporarily present a risk.
The CCTV system should be adapted to the specific conditions of the facility. It is common that CCTV
systems are functional under artificial and low level lighting conditions. Outdoor cameras should be
kept in appropriate environmental housings.
CCTV footage should provide a clear and suitable image for assessment and evidentiary purposes,
and should be recorded by a digital video recorder with a minimum of 96 hours of recordable
storage capacity. The digital video recorder response must be rapid enough to record any intrusion.

ØProvide basic security awareness training	
  to individual(s) responsible for the security of sources andother selected staff (such as radiographers, drivers...) as appropriate.

Ø

As much as possible,	
  do reliability checks on key staff.	
  Based on national legislation and practices, reliability checks may include verification of criminal
records, credit situation, job references, etc.

Ø

Draft a security plan	  that gathers together all security related information (roles and responsibilities,
organisation, measures, procedures...).

ØThe security plan should include response arrangements, and roles, responsibilities andcapabilities of on-site and off-site organisations in case of a security incident.

Ø

Determine the actual status of security arrangements.
Periodically schedule drills and exercises (both tabletop and field exercises) to evaluate theadequacy of security and response procedures and arrangements and determine the status of theirimplementation.

INDUSTRIAL RADIOGRAPHY SOURCES BEING TRANSPORTED BY COMPANY-OWNED VEHICLEØ

Install an alarm system on the vehicle	
  to detect an intruder attempting to enter the vehicle.
At a minimum, a local audible alarm should be activated in case of intrusion. Preferably, the vehicle
should be equipped with an alarm system capable of sending a signal (e.g., cellular/radio, etc.) to
the driver and other selected remote staff/locations.

Ø

Equip vehicle with anti-theft device.
Consider the installation of a remote engine cut-off capability (if allowed by company policies andrelevant safety authorities).

Page	
  11	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
Ø

Track the vehicle.
Consider the installation of a tracking device reporting the position of the vehicle.

Ø

Install a high security lock on the door to the cargo compartment.
Whenever possible, the lock should have a shielded shackle to prevent the cutting of the lock. To
ensure balanced security, the cargo compartment walls and hinges of door should provide at least
equal delay as the door high security lock.

Ø

Install a high security lock on the radiography device transport container.
To ensure balanced security the transport container should be tied down to the vehicle and its
construction should provide at least equal delay as the high security lock.

Ø

When practical,	
  enforce a two-person rule for access to the radiography device.	
  One way to do this is to provide one individual with the key to the vehicle cargo compartment andanother one with the key of the source transport container.
In instances where a strict two-person rule cannot be implemented (e.g., operational reasons), thecompany should demonstrate that they have instituted alternative physical or procedural measuresthat provide reasonable assurance against an insider threat during transportation.

ØTo the extent possible,	
   drivers and/or other transport staff should maintain constant surveillanceof the vehicle.	
  Periods when the vehicle is left unattended should be kept to the strict minimum. Wheneverpossible, the vehicle should be parked in areas which are continuously under surveillance (e.g.,parking garages with attendants). When left unattended, vehicles should be locked and alarms
activated.

ØProvide driver(s) and other transport staff with means of communication such as cell phones,
radios, satellite phones.	
  Redundant means of communication would be useful to compensate for the lack of coverage of any
one technology. In the absence of any reliable means of communications due to lack ofinfrastructure or remoteness of location, the company should implement pre-planned periodic
checks for the timely detection of any incident.
If possible, provide mobile duress alarms for use by the drivers in transit. The buttons should
provide an alarm indication at the company alarm station (if applicable) and off-site alarm station(such as security contractor monitoring stations).

Ø

In areas where there is a high level of threat,	
   conduct route planning	
   to identify potential threats
and existing response authorities (police, security contractors...) in order to select the mostappropriate route and alternates.

Page	
  12	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
When possible, have pre-arranged agreements with appropriate law enforcement for assistance in
response to an actual or attempted theft of radiography sources. If extensive preplanning is notrealistic, then at a minimum, the company should develop a list of the appropriate authorities tocontact in the jurisdictions where the transports are occurring.
ØProvide drivers and other transport staff with written instructions	
   to be implemented in case of
security related event.
These instructions should include, among others, locations of authorised stops (eating, fuelling, rest,
long term parking...), operation of the alarm system, access procedure to the cargo compartment,
actions to be taken in case of theft of the vehicle, phone numbers of key company staff and relevant
law enforcement agencies.
These instructions should be developed in coordination with other applicable transport instructions(operations, safety...).

ØAs much as possible,	
  do reliability checks on drivers and other transport staff.

Ø

Coordinate with the client on the arrival and placement of sources at field locations.
Transport staff should also confirm source arrival to their management.

Ø

Draft a security plan	   that gathers together all transport security related information (roles andresponsibilities, organisation, measures, procedures...).	
  ØDetermine the actual status of security arrangements	  Periodically schedule drills and exercises to evaluate the adequacy of security and response
procedures and arrangements and determine the status of their implementation.

TRANSPORT BY A THIRD-PARTY CONTRACTORØThe contract with the transport company should require security measures consistent with thosedetailed above (Transport by company-owned vehicles). In particular, the contract should covermeasures to keep control of radiography sources (including detection and delay measures), route
planning, communications, confirmation of delivery and procedures in case of an incident.
The transport company should be	
   licensed and certified to transport	
   the radioactive material
sources and the drivers should be adequately trained for their responsibilities.

Ø

Whenever possible,	
   schedule company personnel to be present when sources arrive	   at thedestination.

Ø

Request copies of route planning documentation	  and, where possible,	
  request periodic informationon the position of the vehicle.	
  Ø

Record transport information	
   prior to shipment (license plate numbers, make/model of vehicle,
driver’s name, etc.) and after the transport (copy of transport documents, confirmation of delivery...).

Page	
  13	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
TEMPORARY JOB SITESØRadiography devices should be kept under constant surveillance by a radiographer orradiographer’s assistant when not stored in the transport vehicle or in secure temporary storage.
Surveillance could be performed either by visual or electronic surveillance.
When constant surveillance is not practical, the presence of the radiography device should bechecked periodically by company personnel or personnel assigned by the site operator (ifapplicable), such as the guard force. It is important to note that this will result in a delay todetection.

ØRadiography devices not in use should be kept in the transport vehicle or in secure temporarystorage.
The temporary storage room (or area) should have some form of access control and intrusion
detection that would provide an alarm annunciation to company personnel on site.
Preferably, portable radiography devices should be stored inside an additional container designed tominimize theft opportunities (locked and weighted down; tied down to the floor...).
When possible, keys for accessing the storage locations and storage containers should be
separated between different employees.
In the absence of a formal agreement with the customer, primary responsibility for control of theradiography device rests with the radiography company.

Ø

Provide radiographers and other company staff with means of communication	
  such as cell phones,
radios, satellite phones.
If possible, provide means of communication equipped with mobile duress alarms. These devices
should provide an alarm indication at a permanently staffed location (either at temporary job sites,
company headquarters or private security monitoring stations).

Ø

In locations where there is a high level of threat,	
   identify the responsible person for security at thefield location and review security arrangements with appropriate site personnel.
The briefing should cover, among others, possible consequences in case of loss of control of theradiography sources and basic procedures to be implemented in case of attempted or actual theft.

Page	
  14	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  

EXAMPLE OUTLINE FOR A SECURITY PLAN
Chapter I

Introduction

I.1

Background

I.2

Objective

Chapter II

Organisation of the Company for Managing Security

II.1 Roles and Responsibilities for Security
II.2 National Regulatory Compliance Requirements
II.3 Training Programme
II.4 Performance Testing Programme
II.5 Maintenance Programme
II.6 Budget and Resource Planning
II.7 Background Checks
II.8 Information Protection
Chapter III

Facility Description

III.1

Isotopes and Quantities of Concern / Categorization of Radioactive Sources

III.2

Description of Facility and Surrounding Environment

III.3

Security System Design
III.3.1

Threat Assessment

III.3.2

Security Assessment Methodology

III.3.3

Definition of Security Layers

III.3.4

Access Control Measures

III.3.5

Description of Technical Barriers

Chapter IV

Operational Security Procedures

IV.1

Routine, Off Shift, and Emergency Operations

IV.2

Opening and Closing of Facility

IV.3

Key and Lock Control Measures

IV.4

Source Accounting Measures

Chapter V

Response Planning

V.1

Communications Plan

V.2

Emergency Response and Contingency Planning

V.3

Security Event Reporting

Page	
  15	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
	
  
	
  

APPENDICESAPPENDIX A - QUESTIONS TO ASSESS PERSONAL CONTRIBUTIONS TO THE
SECURITY OF INDUSTRIAL RADIOGRAPHY RADIOACTIVE SOURCES
APPENDIX B - DEFINING DIFFERENT LEVELS OF ORGANISATIONAL SUCCESS

	
  
	
  
	
  
	
  
	
  

	
  

Page	
  16	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
APPENDIX AQUESTIONS TO ASSESS PERSONAL CONTRIBUTIONS TO THE SECURITY OF
INDUSTRIAL RADIOGRAPHY RADIOACTIVE SOURCES
Appendix A contains a series of questions that members of an organisation can use to evaluate thesecurity of their industrial radiography radioactive sources. The questions also make excellent
prompts for generating discussion. Such a process helps individuals at all levels of an organisationreflect critically on their personal actions and behaviour. It also helps them understand how they cancontribute personally to enhancing the security of these sources within their organisation.

	  QUESTIONS FOR THE EXECUTIVE MANAGERS6 OF AN INDUSTRIAL
RADIOGRAPHY COMPANY
Do you believe that there is a possibility that your radioactive sources could be stolen
and a special effort is required to prevent that?

Yes

Does the Owner(s)/Board of Directors routinely consider the various aspects of securityof industrial radiography sources?

Yes

Are you aware if there has been an evaluation of the threats to your radioactive
sources?

Yes

Are you aware of your potential liabilities in case of malicious use of your sources?

No

No

No
Yes
No

Have you approved standards or policies for the security of sources during the various
operations involving them (at company location, at temporary job site and duringtransportation)?

Yes

Have you approved a training programme for individuals involved in the security of yourindustrial radiography sources?

Yes

No

No

	
  

	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  	
  
6 Executive managers can be a Board of Directors, owner(s) or others who have the final responsibility for a company’s
actions.

Page	
  17	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
QUESTIONS FOR SENIOR MANAGERS AND SUPERVISORS OF AN
INDUSTRIAL RADIOGRAPHY COMPANY
Do you believe that there is a possibility that your radioactive sources could be stolen
and a special effort is required to prevent that?

Yes

Do you conduct periodic meetings (either separately or during safety or operational
meetings) with your staff on security threats or requirements?

Yes

Do you have security procedures for protecting sources at your premises?

Do you have security response arrangements (police, security vendor...) in place?

Do you perform background checks of radiographers, drivers and other key staff?

No

No
Yes
No
Yes
No
Yes
No

Is there a regular training programme for individuals involved in the security of industrial
radiography sources?

Yes

Do you have specific security features and procedures for vehicles transporting sources(e.g. route planning, pre-arranged plans with law enforcement, vetting of drivers,
exercises, delivery confirmation...)?

Yes

Do you consider security arrangements at temporary job sites as effective as atcompany location and during transport?

Yes

Do you periodically exercise your security arrangements and procedures?

	
  

Page	
  18	
  of	
  21	
  

No

No

No
Yes
No

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
QUESTIONS FOR INDUSTRIAL RADIOGRAPHY FIELD STAFF
Do you believe that there is a credible threat to the industrial radiography sources youuse?
Are you implementing security procedures to protect your sources against theft?

Have you received written instructions in the event of a security incident?
Have you received training for implementing the security procedures? Do you consider it
adequate?
Are you confident with the level of security for your sources?
Have you been involved in a response exercise for a security event involving yoursources?
Is the level of security during transport as effective as at company location?

Is the level of security at job sites as effective as at company location?
If you observe any suspicious behaviour, in particular at job sites, do you know who toreport it to or what to do?

	
  

Page	
  19	
  of	
  21	
  

Yes
No
Yes
No
Yes
No
Yes
No
Yes
No
Yes
No
Yes
No
Yes
No
Yes
No

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
APPENDIX B
DEFINING DIFFERENT LEVELS OF ORGANISATIONAL SUCCESS
The following chart presents five levels of security of industrial radiography sources each with its own
set of characteristics. By identifying where your organisation falls on this chart, you will know what you
need to do to move to the next level to improve the security of these sources.

LEVEL

CHARACTERISTICSa) Management is aware of the credible threats to the sources and knowledgeableof the possible consequences resulting from malicious act.

1
WORLD
CLASS

b) The organisation has a detailed security plan which clearly delineates theauthority and accountability of security management.
c) An extensive vetting programme is in place which includes background checks,
reference checks, trustworthiness determinations, as allowed by company polices
and national laws.
d) A two-person rule for access to the sources at the base, in transport and at thesite has been implemented and operates effectively.
e) A response plan has been developed and contacts are made to the local law
enforcement authorities to make them aware of the sources and support needed
in a security emergency. Response exercises are conducted periodically,f) A training programme is in place to provide security awareness to individuals
responsible for the sources or working with them. Refresher training is provided
at least every 2-3 years. The competency of radiographers for their
responsibilities is assured.
a) Management is aware of possible threats to the sources and has a grasp of thepossible consequences resulting from malicious act.

2
HIGHLYEFFECTIVEb) The organisation has a security plan which reflects the authority andaccountability of security management.
c) Vetting is in place which includes reference checks which are as allowed bycompany polices and national laws.
d) A two-person rule policy is in place but not always fully implemented in practice.
e) Contacts are made to the local law enforcement authorities to make them awareof the sources and support needed in an emergency. Response exercises are
conducted occasionally.
f) A training programme is conducted to provide security awareness to individuals
responsible for the sources or working with them. The competency ofradiographers for their responsibilities is considered.

Page	
  20	
  of	
  21	
  

WINS International Best Practice Guide

Security of Industrial Radiography Sources

	
  
	
  
a) Management is aware that it is responsible for securing the industrial radiographysources.

3GOODb) The organisation has operational procedures which delineates the management
accountability for security.
c) A vetting programme has been developed but not fully implemented because ofslow or inadequate responsesd) A two-person rule for access to the sources at the fixed Location but not always
applied at other locations and in transport.
e) Contacts have been made to the local law enforcement authorities about thepossible need for support in an emergency. Response exercises have not been
conducted.
f) Security awareness training is provided to individuals responsible for the sourcesin a structured manner.

4
DEVELOPING

5
INEFFECTIVEa) Management is aware that it is responsible for assuring the security of theindustrial radiography sources.
b) Sources are locked most of the time but occasionally when inconvenient to do so,they may go unattended.
c) There is no vetting of personnel who handle the industrial radiography sources.
The two-person rule is applied where convenient.
d) There is little concern about incident planning but contacts have been made withlocal law enforcement authoritiese) Some security awareness and procedures training is conducted but not on a
structured basis.
a) The organisation does not have a security plan and is not clear who has the
responsibility for assuring the security of the industrial radiography sources.
b) Sources are routinely left unattended, particularly during transport.
c) There is no vetting of personnel who handle the industrial radiography sources
and a two-person rule is not generally applied.
d) There is no response plan in the event of a security incident involving the sources
and, consequently, there are no response exercises.
e) There is little training on security awareness or procedures for individuals
responsible for the sources or working with them.

	
  
	
  
	
  
	
  
	
  
	
  
	
  
Page	
  21	
  of	
  21