IMPLEMENTING GUIDANCE FOR LICENSEES THAT

POSSESS RADIOACTIVE MATERIAL QUANTITIES OF CONCERN

Access Control

The objective is to limit “access” to radioactive material quantities of concern and devices

containing radioactive material quantities of concern (devices) so that the risk of theft,

sabotage, or unauthorized use is minimized. Access means that an individual could exercise

some physical control over the material or device. These access control requirements

supplement existing regulations that address security and control of radioactive material by

further limiting unescorted access to only those individuals approved by the licensee. 

If access to radioactive material quantities of concern or the device is required by an individual

who has not been approved for unescorted access, the non-approved individual must be

escorted by an approved individual. Escorting means maintaining line of sight with the escorted

individual. Licensees should also establish a means by which individuals approved for

unescorted access can be visually distinguished from those requiring escort. For example,

those approved for unescorted access to radioactive material quantities of concern or the

device could wear specially colored badges or other identifying articles. This may assist facility

personnel in early detection of unauthorized access to radioactive material quantities of concern

or the device.

Control of access to radioactive material quantities of concern and the device can be achieved

by the following examples: 

Limiting distribution of keys, keycards, or combinations to doors and gates to approved

individuals;

Remote activation of locked doors and gates using remote surveillance;

Using a card reader and electronic locking devices at control points; and

Constant surveillance by a person approved for unescorted access.

These requirements also apply at temporary job sites. Additionally, when transporting

radioactive material quantities of concern, including the device, to and from a temporary jobsite,

access control shall be maintained when the transport vehicle is stopped at a hotel, restaurant,

gas station, or other location.

Detection and Assessment

The licensee shall have a documented program to immediately detect unauthorized access to

material when it occurs, assess whether the unauthorized access was an actual or attempted

theft, and if so, initiate appropriate response. The objective is to reduce the risk that the

material will be stolen and used for unauthorized purposes, and improve the opportunity for

recovery if stolen.

In order to facilitate the immediate detection, assessment and response, the radioactive

material quantities of concern and devices containing such material shall be monitored to detect

unauthorized access. Monitoring may be accomplished by a variety of means, including:
2

Enclosure 2

 • a monitored intrusion alarm (an intrusion detection system with the capability to detect

unauthorized access and that is linked to an on-site or off-site central monitoring

facility);

 • electronic devices for intrusion detection (alarms that will alert nearby facility personnel);

or

 • visual monitoring (video surveillance cameras, and/or visual inspection by trained

personnel).

Systems used to control access to high radiation areas as required by 10 CFR Part 20, or

equivalent Agreement State Regulations, or other detection and access control systems used

for radiation protection may be used or modified, provided the modifications do not compromise

the original safety purpose. Documentation should describe how these systems provide the

required intrusion detection. 

The licensee is responsible for enhanced monitoring during source delivery and shipment when

the delivery or shipment exceeds 100 times the Table 1 values. Some examples of enhanced

monitoring are providing additional personnel to monitor the radioactive material or increasing

video surveillance of the radioactive material. When a service provider takes temporary

possession of a source at a licensed facility, during these activities, the licensee, not the service

provider, is responsible for the enhanced monitoring as well as the other requirements. 

The licensee shall establish a program for assessing and responding to unauthorized access so

that prompt mitigating measures can begin. Assessment can be by either automated devices

or trained personnel who can initiate the appropriate response. Licensees should consider the

possibility of simultaneous alarms at multiple locations. The program’s documentation shall

describe the processes as to how the licensee would assess and respond to unauthorized

access.

These requirements also apply at temporary job sites. Additionally, when transporting

radioactive material quantities of concern to and from a temporary jobsite, detection and

assessment capability shall be maintained when the transport vehicle is stopped at a hotel,

restaurant, gas station, or other location.

In the event of any actual or attempted theft, sabotage, or diversion of radioactive material

quantities of concern or the device, the licensee shall notify the local law enforcement agency

(LLEA) immediately, followed soon thereafter by a call to the NRC Operations Center at

(301) 816-5100. Telephone calls to notify the NRC or State regulatory agencies should be as

prompt as possible, but not at the expense of causing delay or interfering with LLEA response

to the event.

Licensees shall have a prearranged plan with the LLEA that will respond to an actual or

attempted theft of radioactive material quantities of concern or the device. One of the purposes

of establishing liaison with the LLEA is to provide them with an understanding of the potential

consequences associated with theft or sabotage of the radioactive material of concern so that

the LLEA can appropriately determine the priority of its response. Licensees should inform the

LLEA of the quantities of radioactive material that may be involved and the potential hazards

associated with loss of control of the material. The licensee should also provide any facility
3

information important to preplanning for an event response, establish licensee points of contact

for recovery plans and radiation protection education, and work with the LLEA to develop a plan

for a timely response. Licensees should determine, with the LLEA, the preferred method for

contacting them to assure a timely response. The plan shall be consistent in scope and timing

with realistic potential vulnerability of sources containing radioactive material quantities of

concern (i.e., greater quantities require a faster response time and more response personnel. 

The pre-arranged plan shall be updated when changes to the facility design or operation affect

the potential vulnerability of the sources.

A pre-arranged plan with the LLEA is not required at temporary job sites. However, licensees

must still meet the requirements of IC 2.a. by immediately requesting assistance from the

appropriate LLEA with jurisdiction for the area, of any actual or attempted theft, sabotage, or

diversion of radioactive material quantities of concern or the device. When making a

notification to the LLEA at a temporary job site, provide the LLEA with the quantities of

radioactive material involved and the potential hazards associated with loss of control of the

material.

As required by IC 2.c., it is necessary that the licensee have a dependable means to transmit

information to the various components involved in the detection and assessment of an intrusion,

including with the appropriate responder. Land line phones, auto dialers, cellular phones,

pagers, radios, and other similar modes of communication may be used to fulfill this

requirement. Using a radio or cellular phone as a backup to land line phones should be

considered. When more than one person is used for detection and assessment, a means of

communicating among the various monitoring personnel shall be provided. 

Licensees shall establish written procedures for responding to events ranging from an

inadvertent unauthorized access that would not require an LLEA response, to a malevolent

intrusion that would require intervention by LLEA. These procedures should include provisions

for immediate response, after-hours notification, handling of each type of emergency, events at

temporary job sites, and the appropriate roles of the licensee’s staff. The licensee staff should

have a clear understanding of their responsibilities and limitations in an emergency, along with

step-by-step instructions and clear guidelines for whom to contact. Note, that when developing

enhanced control measures, the licensee should not compromise facility operational safety,

occupational safety, fire safety, and emergency planning at the facility. Implementation of

enhanced control measures should enhance safety.

Licensees should amend their training program for employees to include the licensee’s

procedures for implementing these requirements. Training should address the access control

system employed and notification procedures in the event of an unauthorized access and

potential malevolent activities. It should also include the process for reporting any suspicious

activities to management. 

Coordination of Radioactive Material Shipments

The objective of these requirements is to ensure timely detection of any loss or diversion of

shipments containing radioactive material quantities of concern so that the licensee can initiate

an appropriate investigation and response. 
4

When shipping quantities of radioactive material equal to or greater than the Table 1 values,

per consignment, by a carrier other than by the licensee, the licensee shall seek reasonable

assurance the carrier meets each of the requirements of IC 3.a. If the carrier has a tracking

and security plan that the U.S. Department of Transportation requires for shipments of highway

route quantities of radioactive material, the licensee shall verify and document that the carrier’s

tracking and security plan meets each of the requirements of IC 3.a, or obtain written

confirmation that the carrier will implement these provisions.

As required by IC 3.b., licensees shall notify the NRC, in writing, 90 days before the anticipated

date of shipment of radioactive material that exceeds 100 times the Table 1 quantities, per

consignment. The NRC has Additional Security Measures (ASMs) for transportation of

Radioactive Material in Quantities of Concern (RAM QC) which the Commission has

determined are Safeguards Information - Modified Handling (SGI-M). SGI-M must be protected

from unauthorized disclosure and no person may have access to SGI-M unless the person has

an established need to know for the information. SGI-M related to the transportation of RAM

QC must be protected in accordance with the Commission’s November 5, 2004, order imposing

SGI-M handling requirements on such information. That order can be found in the Federal

Register at 69 Fed. Reg. 65470 (November 12, 2004). Because this group of licensees is not

expected to be regularly shipping RAM QC, the NRC does not intend to release this SGI-M to

licensees unless there is a demonstrated need to know. When a licensee notifies the NRC that

it intends to ship such material, the NRC would then issue an additional Order for the

transportation ASMs. Unless notified otherwise, in writing, by the NRC, licensees shall not ship

the material before implementing the RAM QC transportation ASMs.

Once the licensee has implemented the ASMs, the licensee shall be exempt from the

notification requirements of IC 3.b. for future shipments of radioactive material above Table 1

quantities, per consignment. However, the licensee is not exempt from other transportation

reporting requirements. The licensee shall implement the additional controls for all future

shipments of radioactive material above Table 1 quantities, per consignment. 

If a manufacturer and distributor (M&D) licensee takes possession of the radioactive material at

the shippers facility and ships the radioactive material under its M&D license, or implements the

Transportation RAM QC ASMs for the shipping licensee, the licensee subject to this

requirement shall be exempt from the requirements in IC 3.a. and IC 3.b. 

When the licensee transports licensed radioactive material quantities of concern (e.g., to and

from a temporary job site), the requirements of IC 1 and IC 2 shall be met.

Physical Barriers

Due to ease of movement, mobile and portable devices are particularly vulnerable to attempted

theft or diversion; it may be possible for a mobile device to be removed before the licensee has

an opportunity to respond to an intrusion. The objective of this requirement, therefore, is to

delay an unauthorized entity long enough to provide additional time for the licensee and the

LLEA to respond. This requirement requires licensees to have two independent physical

controls that form tangible barriers to prevent unauthorized removal of mobile devices that are

intended to be moved outside the facility (e.g., that are on trailers) and portable devices

containing radioactive material quantities of concern that are not in use. 
5

Examples of two independent physical controls at a licensed facility are:

 • storage inside a locked storage shed within a secured outdoor area, such as a fenced

parking area with a locked gate; or

 • storage in a room with a locked door within a secured building for which access is

controlled by lock and key or by a security guard; or

 • storage inside a locked, non-portable cabinet inside a room with a locked door if the

building is not secured.

Examples of two independent physical controls when securing the radioactive material

quantities of concern in or on a transportation vehicle are:

 • stored in a box physically attached to a vehicle, and the box is secured with two

independent locks; two separate chains or steel cables that are locked and attached

independently to the vehicle in such a manner that the box cannot be opened without

the removal of the chains or cables; or

 • stored in a box in a locked trunk, camper shell, van, or other similar enclosure and is

physically secured to the vehicle by a locked chain or steel cable in such a manner that

one would not be able to open the box and remove the portable or mobile device without

removal of the chain or cable.

Examples of two independent physical controls when at a temporary jobsite or at locations other

than a licensed facility or licensee’s vehicle, are:

 • stored inside a locked building, in a locked non-portable structure (e.g., construction

trailer, sea container, etc.), or in a locked garage, and is physically secured by a locked

chain or steel cable to a non-portable structure in such a manner that an individual

would not be able to remove the device without removing the chain or cable. A source

must be inside a locked, non-portable cabinet or locked box that is secured to a nonportable structure.

 • stored in a locked garage, and is within a locked vehicle or is physically secured by a

locked chain or steel cable to the vehicle in such a manner that an individual would not

be able to remove the device without removing the chain or cable.

For devices in or on a vehicle or trailer, licensees shall also utilize a method to disable the

vehicle or trailer when not under direct control and constant surveillance by the licensee. 

Examples of acceptable methods include: trailer hitch locks, wheel locks (“boots”), or methods

to disable the vehicle’s engine.

For mobile devices that are used inside a facility, additional delay may be accomplished by a

variety of physical controls, including:

 • speed bumps on floor too large for device to traverse ;

 • elevated doorway thresholds;

 • protective storage enclosures; 
6

 • channels in floor large enough to catch the device wheels; 

 • wheel locks (made of hardened material) that require key or special tool to release; or

 • a hardened chain and lock that cannot be easily cut.

The additional physical controls should not compromise safety. If improperly implemented,

some of the suggested items may compromise occupational safety.

Information Protection

The information generated by licensees which must be protected is information about its

physical protection (security and controls) for radioactive material of concern, and includes but

is not limited to: information describing how the radioactive material is secured from

unauthorized removal or access when it is in storage, information describing how the licensee

controls and maintains constant surveillance of the radioactive material when not in storage,

information describing specific policies and procedures for actions taken by the licensee in

response to the increased controls, and the details of the enhancements implemented for the

radioactive material covered under this requirement. Such information is referred to as

“sensitive information.” 

The following discussion provides guidance licensees should follow to ensure compliance with

the information protection requirements for IC 6:

(1) the licensee’s policies and procedures must include general performance requirement that

each person who produces, receives, or acquires the licensee’s sensitive information to ensure

that such information is protected against unauthorized disclosure; 

Dissemination of licensee’s sensitive information is limited to individuals who have an

established need-to-know and who are trustworthy and reliable. Other than those individuals

authorized by the licensee, members of certain occupational groups may be deemed

trustworthy and reliable by virtue of their employment status. These occupational groups are:

 1. An employee, agent, or contractor of the Commission, or the United States

Government;

 2. A member of a duly authorized committee of the Congress;

 3. The Governor of a State or his designated representative;

 4. A representative of the International Atomic Energy Agency (IAEA) engaged in activities

associated with the U.S./IAEA Safeguards Agreement who has been certified by the

NRC;

 5. A member of a state or local law enforcement authority that is responsible for

responding to requests for assistance during security emergencies; or

 6. A person to whom disclosure is ordered pursuant to Section 2.709(f) of Part 2 of Part 10

of the Code of Federal Regulations.

 7. State Radiation Control Program Directors (and State Homeland Security Directors) or

their designees.

If there is any indication that the recipient would be unwilling or unable to provide proper

protection for the licensee’s sensitive information they should not be authorized to receive it.
7

(2) the licensee’s policies and procedures must address how to protect sensitive information

while in use, storage, and transit;

The licensee should store the information in a locked cabinet, desk, office, etc. Information

stored in non-removable electronic form should be password protected. Licensees need to

address how employees need to protect the sensitive information while in their possession both

at and away from the office. Access to the keys, combinations, passwords or other means

used to secure the information needs to be limited to those persons authorized.

(3) the licensee’s policies and procedures must address the preparation, identification or

marking, and transmission of documents or correspondence containing the licensee’s sensitive

information;

The licensee generated sensitive information should be marked in such a manner to assure

easy identification and to ensure proper handling. The front and back of folders containing

sensitive information should be marked for easy identification and to ensure proper handling.

Documents that do not in themselves contain sensitive information but are used to transmit one

or more documents containing this information should be marked to indicate the fact that

sensitive information is contained in the documents transmitted. Transmittals to the NRC

should be marked: “Withhold from Public Disclosure in Accordance with 10 CFR 2.390." 

For Agreement State licensees, transmittals should be marked in accordance with equivalent

Agreement State requirements. These markings should be placed at the top and bottom of

only the first page of the transmitted document. 

(4) the licensee’s policies and procedures must address how access to the licensee’s sensitive

information is controlled; 

Dissemination of sensitive information by licensees must be limited to individuals that have a

“need-to-know” a licensee’s security information to perform their job duties, and are determined

trustworthy and reliable using criteria consistent with those requirements in IC 1. Access by

licensee employees, agents or contractors must include both an appropriate need-to-know as

determined by the licensee, as well as an appropriate determination concerning the

trustworthiness and reliability of individuals having access to the information. Employees of an

organization affiliated with the licensee’s company, e.g., a parent company, may be considered

as employees of the licensee for access purposes. Licensee’s should assure that individuals

not authorized to receive such information do not overhear conversations relating to the

substantive portions of the sensitive information. 

(5) the licensee’s policies and procedures must include acceptable methods for destruction of

documents containing sensitive information; 

Documents containing sensitive information should be destroyed by a method that will prevent

reconstruction of the information. Documents may be destroyed by tearing them into small

pieces or by burning, pulping, pulverizing, shredding, or chemical decomposition. (Note: 

sensitive information should not be sent to recycling without being destroyed first)

(6) the licensee’s policies and procedures must include use of automatic data processing

systems containing sensitive information;
8

Sensitive information may be processed or produced on an Automated Information System

(AIS) provided that the user is appropriately briefed on the proper procedures while using the

computer system. Individuals should protect the information during use by maintaining control

and by ensuring only individuals with the appropriate “need-to-know” have access to the

information. 

(7) the licensee’s policies and procedures address removing documents from the licensee’s

sensitive information category when they become obsolete or no longer sensitive.

Periodic review of documents containing sensitive information to determine whether these

documents should remain in this category is not required. However, this review is necessary

only when specific circumstances require such action. 
9

Definitions

Access Control - A means to allow only those individuals approved by the licensee, unescorted

access to radioactive material. 

Assessment - Licensee’s capability to ascertain cause of alarm condition.

Approved Individual - Those individuals who the licensee has determined are trustworthy and

reliable based on an appropriate verification. 

Consignment - A package or group of packages of radioactive material that a licensee offers for

transport in the same shipment.

Delay - To impede or hinder the progress of an intruder. 

Dependable means to Transmit Information - Intrusion detection system and components which

are used to detect, inform assessor(s), and summon responder(s), such that the system and

components have continuous or alternate communication capability, even in the event of the

loss of primary power or the loss of primary communication means.

Detect - To discover all unauthorized access to the radioactive material quantities of concern or

device.

Radioactive material quantities of concern - Licensed radioactive material that individually or in

aggregation is greater than the quantities in Table 1. The unity rule is used to determine if the

activity of aggregated sources of different radionuclides is greater than the Table1 quantities

(see discussion following Table 1).

Immediately detect, assess, and respond - Detect, assess, and respond without delay. 

LLEA - Any local law enforcement agency at the State level and below to include local

jurisdictions. 

Mobile device - A device containing licensed radioactive material that is mounted on a

permanent base with wheels and/or casters for moving while completely assembled. Portable

equipment means a device containing licensed radioactive material that is designed to be handcarried, and stationary equipment means a device containing licensed radioactive material

which is installed in a fixed location.

Monitor - Capability to observe and detect unauthorized access.

Need-to-know - means a determination, by a person having responsibility for protecting the

licensee’s sensitive information, that a proposed recipient's access to the licensee’s sensitive

information is necessary in the performance of official, contractual, or licensee duties of
10

employment. 

Plan with LLEA - A plan which is consistent in scope and timing with realistic potential

vulnerability such that the LLEA acknowledges they can provide a timely response to thwart

unauthorized actions.

Reliable and Trustworthy - An individual who is considered consistently dependable in

judgement, character, performance, and does not constitute an unreasonable risk to the public

health and safety.

Timely Response - Arrival of LLEA or armed responder to thwart unauthorized access and

unauthorized actions associated with radioactive material quantities of concern or device.
Questions and Answers Regarding Increased Controls (IC) and

Implementation for Licensees That Possess Radioactive Material

Quantities of Concern

Table of Contents

Questions

I. Licensee Responses to the Increased Controls

And Implementation .............................................................................................. 1 - 19

II. Increased Controls (ICs)

A. IC 1: Controlling Access

1. Trustworthiness and Reliability for

 Unescorted Access Authorization .................................................... 20 - 47

2. Trustworthiness and Reliability

 of Service Providers .......................................................................... 48 - 55

3. Controlling Access .............................................................................. 56 - 65

B. IC 2: Monitoring, Detecting, Assessing, and Responding

1. Local Law Enforcement Agency Coordination .................................... 66 - 81

2. IC 2, Questions Specific to Portable and Mobile Devices ................... 82 - 85

3. Miscellaneous .................................................................................. 86 - 103

C. IC 3: Transportation Requirements ..................................................... 104 - 122

D. IC 4: Physical Barriers for Portable

 and Mobile Devices .................................................................. 123 - 125

E. IC 5: Documentation and

 Document Retention ................................................................ 126 - 128

F IC 6: Information Protection ................................................................. 129 - 141

III. Inspections: Inspection Process and Agreement State Involvement 

A. Inspection Process and Agreement State Involvement .............................. 142 - 148

B. Agreement State Inspection ....................................................................... 149 - 153

IV. Definitions ....................................................................................................... 154 - 159

V. General

A. Service Providers and Manufacturers and Distributors .............................. 160 - 165

B. Medical Facilities ........................................................................................ 166 - 167

C. Agreement State Licensee Concerns ........................................................ 168 - 170

D. Miscellaneous ........................................................................................... 171 - 201
-2-

I. Licensee Responses to the Increased Controls (ICs) and Implementation

1. Information on how I would be required to respond to this notice when I receive it

does not appear to be included with the implementing guidance. Will my

response include sensitive information?

For NRC Licensees, the information on how to respond to the NRC Order requiring

implementation of the increased controls are contained in the Order itself. For Agreement

States Licensee, the information on how to respond will be provided separately by each

Agreement State licensing organization, based on the method chosen to execute legally binding

requirements. The NRC Orders are not considered sensitive information. Examples of

previous Orders can be found by searching ADAMS or NRC’s website. 

Licensee’s responses to the increased controls and information that contains licensee physical

protection is considered sensitive information and shared only with those having a “need-toknow.” 

NRC licensees’ responses to the increased controls should be marked appropriately with

“Withhold From Public Disclosure Under 10 CFR 2.390.” 

Agreement State licensee’s responses to the increased controls should be marked in

accordance with applicable Agreement State authority for withholding of sensitive security or

proprietary information. 

2. Is there a process for requesting an exemption from specific increased controls?

There is a process by which a licensee may request relief from specific increased controls, or

request an extension for implementing the increased controls. The process is communicated in

the language of the NRC Order or Agreements State regulatory document that requires

implementation of the increased controls.

3. In responding to the increased controls are licensees responsible to send in the

details of their program to the NRC or Agreement State for approval? Could

inspectors then use that approval to see if a licensee in compliance?

No, all programs will be reviewed through inspection. Licensees need to affirm compliance with

the increased controls and provide their anticipated implementation schedule. Inspectors will

review the program during the inspection.

4. Can the response period and implementation period be extended, or timed to

accommodate our fiscal year or the challenges of transferring or disposing of

sources that are no longer in use?

The 25-day response period is adequate for communicating to the licensee’s ability to be in

compliance with the increased controls. The licensee will have 180 days from issuance to

implement the increased controls. The NRC and Agreement States will consider extending the

implementation date if the licensee can show good cause. Extension of time frames will be
-3-

considered on a case-by-case basis. Requests for extension should be made in the initial 25-

day response. Such a request should be accompanied with a time line that sets forth a

proposed schedule for implementation. Individual licensees have different fiscal years,

therefore it would be impractical to time the issuance of the increased controls to coincide with

each licensee’s fiscal year.

5. There are many challenges of transferring or disposing of some sources that are

no longer in use, but which would trigger the implementation of the increased

controls. How can I quickly find a place that will take my unwanted sources?

The NRC does not intend to develop a new source recycling program. However, licensees or

industry groups may wish to develop a system for returning and recycling larger radioactive

sealed sources. If a licensee concludes that a source is no longer wanted or needed, two

programs currently exist that may be able to assist you. The Conference of Radiation Control

Program Directors (CRCPD) National Orphan Radioactive Material Disposition Program

provides information to assist States and the NRC in the disposition of sources (such as

providing a list of waste brokers and individuals who want sources). The mission of the

Department of Energy's (DOE) Offsite Source Recovery Project (OSRP) is to recover and store

excess and unwanted radioactive sealed sources if they are not suitable for disposal in existing

radioactive waste sites. For additional information, the link to the OSRP website is:

http://www.doeal.gov/osrp/. The link to the CRCPD website is:

http://www.crcpd.org/orphans.asp. The link to a CRCPD document describing their program is:

http://www.crcpd.org/SpecialServices&Projects/Orphan_Rad_Mat_Pgm/Announcement.pdf

6. The culture at academic and research institutions (e.g., the common sharing of

keys and access cards) may make enforcement of increased controls a difficult

task.

Institution-wide changes may be necessary in response to these increased controls. Licensees

will have a period of 180 days after issuance to implement the increased controls. The

licensees can use the 180 days to address any issues at the university/hospital research and

educational institutions.

7. Is there flexibility built into the increased controls implementation process?

Yes. The increased controls are purposely not prescriptive to allow licensees to tailor programs

to their specific facility and operations. Various approaches are available to licensees to meet

the objectives of the increased controls, and that there exists no one solution to any material

control challenge facing licensees. The guidance provides examples of how the increased

controls may be met. Licensees do not have to implement any of the examples in the

guidance, but those examples describe acceptable approaches to implementation.

8. Do the increased controls replace current security measures, or are they meant to

enhance measures already in place?

The increased controls are an enhancement to current health and safety requirements, and are

not intended to displace current initiatives being undertaken by licensees. The intent is for

licensees to evaluate their current programs, and enhance them as necessary to meet the

increased controls.
-4-

9. Will NRC or Agreement States be providing possible solutions or recommending

possible vendors to assist in the implementation of the increased controls?

The implementation guidance describes acceptable approaches for complying with the

increased controls. Due to the high variation in licensee facilities and operations, specific

solutions cannot be provide. Furthermore, as a government regulatory agencies, the NRC and

Agreement States cannot provide recommendations on specific commercial vendors. The

guidance provides a general discussion of potential approaches to achieving compliance with

the increased controls.

10. Does the Implementing Guidance require training, who should be trained and can

training already provided for radiation protection purposes suffice?

To assure full compliance and implement the increased controls, it would be appropriate to train

trustworthy and reliable staff, on a “need-to-know” basis, in accordance with the Implementing

Guidance for the Increased Controls. Training on control measures and the increased controls

is different from training for radiation protection purposes, and employees may require

additional training. As noted in the Implementing Guidance, “Assessment can be by either

automated devices or trained personnel who can initiate the appropriate response. The

licensee’s staff should have a clear understanding of their responsibilities and limitations in an

emergency, along with step-by-step instructions and clear guidelines for whom to contact. 

Licensees should amend their training program for employees to include the licensee’s

procedures for implementing these increased controls. Training should address the access

control system employed and notification procedures in the event of an unauthorized access

and potential malevolent activities. It should also include the process for reporting any

suspicious activities to management.”

11. Who should we contact to handle issues that arise regarding the increased

controls, or related issues?

There is NRC or Agreement State contact information provided in the letter transmitting the

increased controls requirements.

12. Will implementing the increased controls be based just on possession limits or

actual physical possession of material over the threshold values?

The requirement to implement the increased controls is based on actually possessing materials

that meet the threshold values identified in Table 1. Possession of quantities just below the

threshold will not require implementing the increased controls. 

13. Will having two or more sources located in the same area such that the two or

more sources, when added together, meet or exceed the threshold quantities

require implementing the increased controls?

If there is no additional physical barrier between the sources or devices such that someone only

has to break into that area to get access to the sources or devices, then the licensee would

have to implement the increased controls, if the sources individually or collectively are greater

than or equal to the quantities listed in the Table 1. With only one common barrier, the sources
-5-

or devices would be considered collocated. An example would be a High Dose Afterloader with

a back up source. If the two sources were stored in the same area, they would be collocated. 

Storing the back up source in the same area in a locked device that could not be removed,

such as a safe, or in a separate locked room could be considered additional barriers such that

the sources do not require the increased controls. Questions do arise, such as if you open the

safe, are they collocated or if you are doing a source change out and, for a short period of time,

have two or more sources meeting the threshold, do you have to implement the increased

controls for that time period. There is an opportunity for licensees to request exceptions to or

variations of some or all of the increased controls. Such requests will be consider if adequate

justification or a proposal for achieving the same objectives as the Increased Control, is

provided by the licensee. 

14. Have the NRC and Agreement States considered that the draft measures letter

dated November 22, 2004, could interfere with patient care?

The increased controls, themselves, are not intended to interfere with patient care and are not

prescriptive. It is the licensee’s responsibility to look at the intent of the increased controls and

determine the best course of action that will provide the added security while minimizing any

impact on work flow and family members’ ability to provide comfort to the patient and not

interfere with patient care.

15. Will Sealed Source and Device (SS&D) Registrations be made available by the

NRC for use in developing a thorough plan?

The NRC has removed public access to the SS&D registry. You may contact your

manufacturer and/or distributor of the source or device or your regulatory agency for

information needed for regulatory compliance.

16. Can licensees perform their own vulnerability assessment and change the time

requirement for detection and response listed in the increased controls?

Yes, although the increased controls do not specify time periods. Assessments have been

performed by experts at a national laboratory. It is imperative that licensees quickly detect,

assess and respond as stated in the increased controls. Notification has to be made as soon

as possible. If for some reason a licensee can not comply with the requirements, the licensee

should inform the NRC or its Agreement State licensing authority, as appropriate, and request

relief from that part of the increased controls.

17. Should day-to-day operational increased control activities be documented, such

as the coming and going of individuals requiring line-of-sight escort? 

The requirement in the increased controls is to have a documented program to monitor and

immediately detect, assess, and respond to unauthorized access to radioactive material in

quantities greater than or equal to Table 1 values. How to document a licensee's "Increased

Controls" will be left up the each licensee and will be verified during an inspection. Having

escorted individuals sign-in and out is an effective way to maintain a record of individuals

having access to the material.
-6-

18. Can economic reasons be used as a means for being relieved from some of the

increased control requirements? 

Requests for exception, relief from, or variation of any specific requirement will be handled on a

case-by-case basis. Licensees need to request exceptions or relief in their response to the

increased controls. All requests for relief must include the licensee’s justification and any

proposal for achieving the same objectives in lieu of those required by the increased controls.

19. Will the Implementation Guidance carry the same regulatory force as the

increased controls themselves?

No. Guidance provides amplifying information and examples of how the increased controls

may be met, but does not impose requirements. Licensees do not have to implement any of

the examples in the guidance, but those examples describe acceptable approaches to

implementation.

II. Increased Controls (ICs)

A. IC 1: Controlling Access

1. Trustworthiness and Reliability for Unescorted Access Authorization

20. Are these trustworthiness and reliability requirements equivalent to those used in

nuclear power plants?

No. Nuclear power plants use other more stringent requirements to determine an employee’s

trustworthiness and reliability (See 10 CFR §73.56 and §73.57). The NRC and Agreement

States have taken a risk-informed approach for different types of licensees for trustworthy and

reliability determinations for access controls.

21. Please provide further clarification regarding the trustworthy and reliability

Increased Control, including suggested procedures for trustworthy and reliability

determinations. 

As per IC 1, to authorize unescorted access to an employee, the licensee must perform, as a

minimum, verification of employment history, verification of education, and verification of

personal reference checks. In addition, to the extent possible, the licensee must also obtain

independent information to corroborate that provided by the employee. It is the licensee’s

responsibility to make a trustworthiness and reliability determination of an employee, contractor,

or other individual who would be granted unescorted access to the device containing

radioactive material, and it is expected that licensees will use their best efforts to obtain the

information required to conduct a background check to determine individuals’ trustworthiness

and reliability. The sole exception is the trustworthy and reliability determination made of

service providers, for which the determination may be made only by the service provider’s

employer (M&D licensee). The determination of trustworthiness and reliability may rely on the

same or similar information evaluated by human resource personnel in their findings of

employability by employers. Information previously obtained during the hiring process may be
-7-

used to support the determination, without having to re-verify that information. Licensees have

the option to make a trustworthiness and reliability determination for those individuals that they

deem necessary to have unescorted access, but also have the option to escort and not make

the trustworthiness and reliability determination. However, if such a corroborative check

becomes impossible, but the licensee concludes the individual should still be authorized for

unescorted access based on other background check information, then the licensee should be

prepared to provide a supporting explanation, in writing, of their efforts to obtain the necessary

information.

22. Will guidance be provided on what determines trustworthiness and reliability? 

No, however, IC1(b) provides the minimum basis upon which a determination may be made.

Alternative sources may be used depending on the information available to the licensee. It is

the licensee’s responsibility to make a trustworthiness and reliability determination for an

employee granted unescorted access. This is a licensee’s business decision as to what criteria

it uses for the bases of the trustworthiness and reliability determination. 

The trustworthy and reliability determination is designed to identify past actions to help verify

one’s character and reputation which provide reasonable assurance of an individual’s future

reliability. 

The following are some indicators that licensees may want to consider for what may be a

trustworthiness and reliability concern:

1. Impaired performance attributable to psychological or other disorders.

2. Conduct that warrants referral for criminal investigation or results in arrest or conviction.

3. Indication of deceitful or delinquent behavior.

4. Attempted or threatened destruction of property or life.

5. Suicidal tendencies or attempted suicide.

6. Illegal drug use or the abuse of legal drugs.

7. Alcohol abuse disorders

8. Recurring financial irresponsibility.

9. Irresponsibility performing assigned duties.

10. Inability to deal with stress, or having the appearance of being under unusual stress.

11. Failure to comply with work directives.

12. Hostility or aggression toward fellow workers or authority.

13. Uncontrolled anger, violation of safety or security procedures, or repeated absenteeism.

14. Significant behavioral changes, moodiness or depression.

These indicators are not meant to be all inclusive or intended to be disqualifying factors. 

Licensees can a also consider extenuating or mitigating factors in their determinations.

23. Why is a trustworthiness and reliability determination necessary?

A trustworthiness and reliability determination provides the licensee reasonable assurance that

the individual allowed unescorted access will not use the material for malicious purposes. The

determination provides a basis upon which access cards and other such security access

devices could be issued. This requirement goes beyond access control for radiation protection

purposes, and further limits access to those individuals who have a legitimate need to access

the material or device.
-8-

24. Can the trustworthiness and reliability requirements be avoided if there are

alternative physical controls or alternative administrative controls and training?

No. All increased controls were designed to provide a defense in depth strategy for the

increased control of radioactive material in quantities greater than or equal to Table 1 values. 

No single measure can provide the same level of protection as all increased controls, in total. 

Therefore, each of the increased controls will require implementation. The NRC and

Agreement States acknowledge that no single component can provide foolproof assurance that

a loss of control will not occur.

25. How does a background check assure trustworthiness and reliability?

It is recognized that a background check cannot provide total assurance that a person granted

access will not use the material for malicious purposes; however, it does provide reasonable

assurance that the individual is who they purport to be, and to determine if the individual’s

character, reputation, and behavior is not adverse to safe operation and does not constitute an

unreasonable risk to commit or aid malevolent use of radioactive sources for the protection of

the public health and safety.

26. How do the NRC and Agreement States perform trustworthiness and reliability

evaluations of licensees?

The NRC and Agreement states do not perform trustworthiness and reliability reviews for

individuals. Currently, the process relies on the demonstrated performance of licensees to

safely handle radioactive materials. Such performance is observed through the NRC and

Agreement State inspection processes. It is the licensee’s responsibility to determine the

trustworthiness and reliability of its employees to have unescorted access to the radioactive

material or device containing radioactive material. 

27. What is sufficient to determine trustworthiness and reliability, and who is

responsible for making the determination? 

The Increased Control provides three elements (educational, employment, and personal

history) needed to complete a minimal trustworthiness and reliability review; however, it may be

necessary to develop additional information beyond that required in the Increased Control to

provide reasonable assurance that an individual granted unescorted access to the material will

not use it for malevolent purposes. There is flexibility in how to structure the process. 

The ultimate responsibility for making a trustworthiness and reliability determination resides with

the licensee; however, the review can be delegated to Human Resources, or other appropriate

departments depending upon your organization. Information previously obtained during the

hiring process may be used to support the determination, without having to re-verify that

information. Licensees have the option to make a trustworthiness and reliability determination

for those individuals that they deem necessary to have unescorted access, but also have the

option to escort and not make the trustworthiness and reliability determination.
-9-

28. How should the trustworthy and reliable determination process for my employees

be documented?

The process must be documented and must include the basis used to develop the

determination for each individual (including the criteria and supporting documentation), the

individual’s name, and should include the date of the determination, and the name and

signature of the person responsible for making the determination.

29. Does the denial of unescorted access have to be documented?

No.

30. Does the denial of unescorted access create legal liability for the licensee? 

The NRC and Agreement States acknowledge that employer liability potentially exists through

the process for determining trustworthiness and reliability, just as employer liability potentially

exists throughout the hiring process. A finding that results in denying someone employment

may be actionable on the part of the employee/employee candidate, and this is no different.

31. How can we address the unique challenges related to establishing

trustworthiness and reliability for foreign nationals (anyone who is not a U.S. 

citizen)?

The NRC and Agreement States agrees that determining the trustworthiness and reliability of

foreign nationals, including students, poses special challenges. An evaluation of academic and

other references (i.e. transcripts, college applications, financial aid applications, etc.), can form

the basis for a trustworthiness and reliability determination. A visa does not, in and of itself,

provide an adequate basis for determining that the individual is trustworthy and reliable. 

Background checks are required to verify and develop information that supports the basis for

the trustworthiness and reliability determination. Licensees must obtain independent

corroborating information to the extent possible. The increased controls incorporate the phrase

“to the extent possible” as opposed to “to the extent practical” to communicate the expectation

that licensees will use their best efforts to obtain the information required. However, if obtaining

such corroborative information becomes impossible, but the licensee concludes the individual

should still be authorized for unescorted access based on other background check information,

then the licensee should be prepared to provide a supporting explanation, in writing, of their

efforts to obtain the necessary information.

32. Why was three years chosen?

A three year period was chosen based on information provided by law enforcement

communities, which is not inconsistent with background investigations required for other

security clearances. The 3-year employment limit is used to differentiate between a

background check that develops information on the individual’s character, reputation and

behavior (if employed by the licensee for 3 years or less) and a background check that relies

mostly on the employer’s observations regarding the employee (if employed by the licensee for

greater than 3 years).
-10-

A three year time period is a reasonable amount of time in which to observe an employee’s

actions and to establish the trustworthiness and reliability of the employee. The review and

investigation for trustworthiness and reliability of an employee or candidate for employment is

envisioned as a one-time event on the part of the licensee, unless other information learned

following the determination could prove to influence the outcome of the initial determination.

33. How far back in time must a licensee look into a potential employee’s historical

information to make the trustworthy and reliability determination?

Licensees should look into a potential employee’s history as far back, to the extent possible, as

is necessary to satisfy themselves that sufficient information is available to meet its own criteria

for the trustworthiness and reliability determination.

34. Do you have grandfather provisions for those who are long-term employees

regarding trustworthiness and reliability?

All employees granted unescorted access must have a determination of trustworthiness and

reliability. The level of investigation needed to develop supporting information in determining

the trustworthiness and reliability of employees who have been employed for over 3 years is not

the same as that required for new or recently hired individuals. 

35. Are you defining three years of employment as “uninterrupted” service, or can

there be breaks in service as long as he’s worked for you for 3 total years?

Three years of service can be concurrent or cumulative as long as the person’s work history

justifies a trustworthy and reliable determination.

36. Why isn’t a criminal background check required?

Licensees in some jurisdictions may not have authority to perform criminal background checks,

and therefore, this was not added to the increased controls. Licensees are encouraged to

implement additional controls, which could include criminal background checks to their

trustworthy and reliability determination process, consistent with applicable laws. 

37. Can one institution’s determination of trustworthiness and reliability for an

individual suffice for another institution’s assertion that trustworthiness and

reliability is met, and can such information be shared among institutions?

Each institution (i.e., licensee) is ultimately responsible for determining the trustworthiness and

reliability of anyone they are granting unescorted access to radioactive material in quantities

greater than or equal to Table 1 values or devices containing such material through the

background check requirement in the Increased Control. Licensees would need to establish

their criteria on which they will base their trustworthiness and reliability determination and obtain

the necessary information that substantiates their criteria. Information gathered from other

sources, including information obtained for a finding of trustworthiness and reliability by another

institution may be one element of the basis for making a new determination at the new

institution. Your human resource and legal personnel can determine if such information may be

shared among institutions. If programs exist for other activities at a licensee’s site that

accomplish the same objectives as the increased controls, licensees do not have to create a
-11-

separate program for their radioactive material. Licensees will need to document how specific

elements of existing programs are used to implement each increased control.

38. Our industry is subject to three different Federal background check programs: 

Bureau of Alcohol, Tobacco, Firearms, and Explosives, The Department of

Transportation (DOT) and the NRC. All three have different requirements. This is

very cumbersome, confusing and costly.

The process used and the information previously obtained through another background check

or the hiring process may be used to support a trustworthy and reliable finding without having to

re-verify the information. However, the individual responsible for the background checks must

document the basis for concluding that individuals are trustworthy and reliable. The

documentation may reference pre-existing records. If programs exist for other activities at a

licensee’s site that accomplish the same objectives as the increased controls, licensees do not

have to create a separate program for their radioactive material. Licensees will need to

document how specific elements of existing programs are used to implement each Increased

Control.

39. Can other individuals (e.g., contract physicians, physicists, laboratory staff,

house-keeping, security staff, or other staff not actually using the device or

material) be authorized unescorted access to a device or radioactive material in

quantities greater than or equal to Table 1 values?

Yes. Other personnel (both licensee and non-licensee) that have job duties that require access

to the room where the device is used or stored may have unescorted access to the material or

device if the licensee has determined they are trustworthy and reliable and there is a need for

them to have access to the material or device. The requirements restricting unescorted access

are for vendors and service providers who are installing, repairing, modifying, or removing the

source containing radioactive material quantities of concern from a device. 

40. If a licensee has determined someone to be trustworthy and reliable, and they

later betray that determination by actually taking the material for malevolent use,

what actions are expected of the licensee? What liability does the licensee

assume because of their background check?

The licensee is required to provide reasonable assurance that persons granted access are

trustworthy and reliable, and if the licensee fails to provide that assurance, the licensee would

be in violation of the increased controls, and enforcement action will be considered. Providing

assurance means that the licensee has taken reasonable efforts as required by the Increased

Control to ascertain trustworthiness and reliability and documented those actions.

Once an incident occurs, the licensee is expected to implement the other elements of their

documented program required by the increased controls, and pursuant to the regulations and

license conditions.
-12-

41. Could security risk assessments described in title 42 CFR 73.8 assist in achieving

certain trustworthy and reliability goals? Note that current impediments to

information sharing (Department of Labor restrictions) among institutions could

restrict the transmittal of important information. 

The "Security Risk Assessment" under title 42 CFR 73.8 could potentially serve as an element

of the basis for a determination that an individual is trustworthy and reliable. Concerns that

other institutions cannot share "Denial of Access" information are duly noted. The NRC is not

pursuing action at this time with regard to this potential impediment to information sharing

among institutions. Each institution (i.e., licensee) granting unescorted access to radioactive

material in quantities greater than or equal to Table 1 values or devices containing such

material is responsible for making its own determination that an individual is trustworthy and

reliable, through the background check requirement in the Increased Control.

42. Can emergency first responders, such as police and fire department personnel be

deemed trustworthy and reliable for the purposes of the increased controls,

without a background check?

Officials of the NRC, state radiation-protection agencies, and local law enforcement authorities

are deemed trustworthy and reliable for purposes of this requirement. In the event of an

emergency, such as a fire or explosion, firefighters may be granted unescorted access for the

purposes of controlling the emergency situation.

43. Can the Human Resources Department be designated to perform the background

checks and be the repository for trustworthy and reliability determination

records? If we have a process in place can we continue to use that process? 

Does the Radiation Safety Officer (RSO) have to be involved?

The review and/or record storage can be delegated to a licensee’s Human Resources or any

other appropriate department depending on its organization. Additionally, the process used and

the information previously obtained through the hiring process or another background check

process, may be used to support a trustworthy and reliable finding without having to re-verify

the information. However, the individual responsible for the trustworthy and reliability

determinations must document the basis for concluding that individuals are trustworthy and

reliable. The documentation may reference pre-existing records. If security programs exist for

other activities at a licensees site, that accomplish the same objectives as the increased

controls, licensees do not have to create a separate security program for their radioactive

material. Licensees will need to document how specific elements of existing security programs

or plans are used to implement each Increased Control. The RSO does not have to be involved

just as along as the objectives of the increased controls are met. However, because safety and

security go hand-in-hand, the RSO is likely to be integrally involved in any decisions and

implementation. 
-13-

44. How do you handle non-disclosure of personal information other than to simply

tell someone calling about employment history they worked for you from one date

to another?

Verification of employment history can be one measure by which you determine a person’s

trustworthiness and reliability.

45. Are you attempting to determine if employees are telling the truth? If someone

has a drug and alcohol problem, does that make them unreliable?

The process has been developed to provide a way for licensees to have reasonable assurance

of a persons true identity and that the individual’s character or reputation is established to be

trustworthy and reliable. Being untruthful and abuse of alcohol are indicators that may be used

to deny a person’s trustworthiness or reliability, but are not necessarily determinative. 

46. How are we going to handle totally new hires that you put through school? How

will you get all the background checks before you put him to work? Are

managers subject to the same background checks?

Background checks on new hires without an employment history will require a review of their

education and personal references. The background investigation for a determination of

trustworthiness and reliability needs to be done before granting unescorted access to the

radioactive material quantities of concern or devices containing the radioactive material,

otherwise the individual may be escorted. Everyone is required to have a trustworthiness and

reliability determination before being given unescorted access to radioactive material quantities

of concern or to devices that contain such material. The level of investigation of the

background check to develop information supporting the determination criteria is different for

those employed more than three years.

47. How does the inspector judge if a licensee’s program for trustworthiness and

reliability checks is adequate?

When it is completed, licensees will be provided informational copies of the Temporary

Instruction for inspection which gives guidance to inspectors. Generally, inspectors will verify

that licensees have performed the trustworthiness and reliability determinations for those

individuals granted unescorted access. This would include looking for documentation of the

criteria used for those determinations and documentation of the information gathered, in the

background investigation (e.g., records of phone conversations) to support that an individual

meets the licensee’s the criteria. Inspectors would generally not second guess a licensee’s

determination if the licensee has information to support its decision. 

2. Trustworthiness and Reliability of Service Providers

48. Why aren’t the NRC and Agreement States issuing increased controls to all

irradiator repair/service providers to have a trustworthiness and reliability

determination of their service personnel?
-14-

At this time, the NRC and Agreement States are issuing increased controls to licensees that

possess their own radioactive material in quantities greater than or equal to Table 1 values and

not to those that only take temporary possession of their customer’s sources for radiation

protection purposes while performing repairs or service. The increased controls issued to

service providers are designed to enhance control for the service providers own sources, and

not for their customers’ sources at the customers’ facilities. The one exception is where the

service provider is also a Manufacturer and Distributor (M&D) licensee and is implementing the

M&D Licensee Additional Security Measures Order of January 12, 2004. In this case, the M&D

licensee can provide certification to their customers that an individual M&D employee is

trustworthy and reliable based on that Order, without its customer licensee having to go through

its own process to make the trustworthy and reliable determination for unescorted access.

49. Can properly qualified service providers be considered trustworthy and reliable

and granted unescorted access to the radioactive material or devices containing

the radioactive material.

Yes, provided the licensee meets the requirements of IC 1. Certain M&D licensees

implementing the NRC’s January 12, 2004, Additional Security Measures (ASMs) Order, have

requirements that exceed IC 1. Therefore, individuals from these M&D licensees, who are

providing service at a customer’s facility, need not go through the customer’s process for

determining trustworthiness and reliability for granting unescorted access. Rather, because the

M&D licensee may already have made its own determination of trustworthiness and reliability,

under the January 12, 2004, Order, for its service personnel, the M&D licensee can provide its

customers with certification of an individual’s trustworthiness and reliability for being granted

unescorted access.

50. During a source disconnect, would trustworthiness and reliability requirements

apply to the individual coming in to provide source retrieval services? What

about an individual who works for another company that provides source retrieval

services and they have performed trustworthiness and reliability background

checks, are those checks are adequate for my company?

Yes, to both questions. Individuals without a trustworthiness and reliability determination would

need to be escorted during source retrieval operations. M&D licensees implementing the

January 12, 2004, NRC Order can provide verification of their employees trustworthiness and

reliability to its customers. Some type of written communication is required from the M&D

Licensee, which includes the employee’s name that will be providing the service, and a

statement to the effect that the employee has been determined to be trustworthy and reliable in

accordance with the NRC Security Orders for M&D licensees.

51. What type of written verification attesting to or certifying a service provider

employee’s trustworthiness and reliability is required from a Manufacturing and

Distribution (M&D) licensee providing the service?

Some type of written communication is required from the M&D licensee, which includes the

employee’s name that will be providing the service and a statement to the effect that the

employee has been determined to be trustworthy and reliable in accordance with the NRC

Security Orders for M&D licensees.
-15-

52. Before a Manufacturing and Distribution (M&D) licensee comes to a customer’s

facility to provide service, will the NRC provide assurance that the M&D licensee

is complying with the M&D licensee Security Order of January 12, 2004?

The M&D licensees issued and implementing the January 12, 2004, Order have notified the

NRC that they are in compliance with that Order. The NRC, as part of its regulatory program

will inspect these licensees to verify compliance.

53. Why do the Manufacturing and Distribution (M&D) Licensee have a more stringent

standard for determining trustworthiness and reliability than these increased

controls ?

M&D licensees’ need trustworthiness and reliability requirements that are more stringent than

required by these increased controls. These requirements have been designated as

Safeguards Information and will not be distributed to other licensees. M&D Licensee service

providers have knowledge, tools, and access to devices that contain sources containing

radioactive material quantities of concern. 

54. Can vendors and service providers not associated with a Manufacturing and

Distribution (M&D) license be provided unescorted access to radioactive material

in quantities greater than or equal to Table 1 values at a customer facility?

No. At this time, only vendors and service providers associated with an M&D license

implementing the NRC Security Order of January 12, 2004, can make a trustworthiness and

reliability determination for individuals that provide service at their customer’s facilities. All other

vendors and service providers must be escorted by a person, from the customer’s facility, who

is authorized to have unescorted access to the radioactive material or device containing

radioactive material. There is need for more stringent trustworthiness and reliability

requirements for M&Ds relative to other licensees, based on the fact that the M&Ds are

intimately more familiar with the devices containing radioactive material quantities of concern

than other licensees. Vendors and service providers not associated with a M&D may also have

intimate knowledge of these devices. However, they do not have possession limits that warrant

the issuance of increased controls that are comparable to those issued to the M&D licensees.

55. Are the NRC and Agreement States considering developing an alternate pathway

for vendors and service providers not associated with a Manufacturing and

Distribution (M&D) licensee to have unescorted access to radioactive material in

quantities greater than or equal to Table 1 values at their customer facilities?

Not at this time.

3. Controlling Access 

56. Can the NRC provide examples of how to best achieve the level of unescorted

access and detection given budget constraints versus risk? 
-16-

Each licensee needs to develop a plan that identifies the areas where radioactive material in

quantities greater than or equal to Table 1 values are located, who has access to these areas,

and how to best achieve compliance with the increased controls. The way to achieve

compliance will vary for each facility. This is a business decision that the licensee needs to

make. 

57. Can we assume that patients can be granted unescorted access during patient

treatments?

Patients who are being treated with devices containing radioactive material of concern, are

usually escorted, monitored, or frequently observed by an approved individual. Access by

patients who are receiving treatment with such devices should be restricted during treatment,

and the licensee shall comply with the increased controls. Patients should not be able to

access areas where radioactive material quantities of concern is stored without being escorted

or confronted by approved personnel.

58. Can the escorted access requirement be waived for hospitals because of the cost,

and safety concerns involved in accompanying patients at all times? Exceptions

are needed for emergency situations.

Licensee must comply with the increased controls and control access of patients who are

receiving treatment with devices containing radioactive material in quantities greater than or

equal to Table 1 values. Escorting individuals who have not been deemed trustworthy and

reliable is required, and patients being treated are usually escorted, monitored, or frequently

observed by an approved individual. Licensees have the ability to identify those areas/rooms

where radioactive material quantities of concern are located and may use a variety of methods

to limit access, escort and monitor patients. Licensees need to determine which methods

would be the most reasonable and practical for there situation. While safety and security are

complimentary, security should not interfere with safety. Licensees can determine their own

best practices or procedures in anticipated emergency situations.

59. Does “access control” (IC 1) require that locks for different rooms be re-keyed to

different keys/combinations?

No. IC 1 requires that only approved individuals have unescorted access to radioactive material

in quantities greater than or equal to Table 1 values. It is up to the licensee to determine how

access will be controlled at their facility. If you are using a key based system for access to

radioactive material quantities of concern, the keys should only be distributed to personnel who

have a need-to-know and have been granted unescorted access. Compliance with this

increased control can only be determined during the inspection process.

60. Self contained irradiators have shown themselves to be very safe for day to day

use without operators having access to the radioactive material. Controlling

access to the radioactive material is generally much easier than controlling

access to the irradiator. Are the increased controls expected to address access

to the radioactive material or to the irradiator? 

In order to address potential malevolent intent, the increased controls were drafted to control
-17-

access both to the radioactive material and to the irradiator. When used properly with no

malicious intent, the devices are inherently safe.

61. Can the requirements in IC 1 (for controlling access) be eliminated because it

seems to be overly burdensome? The radioactive source cannot be easily

accessed for the some types of devices (e.g. blood irradiators, panoramic

irradiators with less than 10,000 curies, teletherapy devices, gamma knife

devices, and afterloader units). Only specifically trained individuals utilizing

specialized equipment could exercise sufficient physical control over these

sources to present a risk of theft, sabotage, or malevolent use. What is the

likelihood that a Co-60 source could be removed from its housing? 

The NRC has engaged the expertise of national laboratories who have shown that these

devices may be vulnerable under certain scenarios. It is for this reason that the Commission

has determined that certain enhanced security measures are necessary in the current threat

environment.

62. Does unescorted access only apply to the storage area? 

No. It applies to all areas where there is radioactive material of concern or devices containing

the radioactive material. 

63. Do the individuals on an oil rig who actually manipulate the tools, but are not

employed by us, have to be approved individuals under the Increased Control?

No, as long as there is an approved individual on the rig escorting these individuals.

64. What should we do if one of our trucks (working under the increased controls)

breaks down and must be towed to a shop for repairs and we are not allowed into

the repair shop bay?

You must still meet the requirements of the increased controls. Your authorized user could lock

the truck, remain at the shop and keep visual contact with the truck in order to control and

maintain constant surveillance of licensed material (as already required by the regulations) to

ensure that the sources/tools are not removed. Alternatively, you could remove the device from

the truck and keep it in your possession until you can have the sources returned to your facility

or the original truck is repaired.

65. Why are the access controls required when most of the Increased Control

duplicates regulation, license condition, guidance, or the licensee’s own safety

procedures addressed for health and safety.

Current regulatory requirements for security and access controls focus on safety to assure

appropriate control of the radioactive material and proper use of devices containing the

radioactive material to meet the standards for protection against radiation. They were not

developed for protecting against determined individuals intent on malevolent use of radioactive

materials. The purpose of the increased controls is to enhance existing security requirements

to reduce the risk of malevolent use. The NRC and Agreement States consider safety and
-18-

security to go hand-in-hand and that existing licensees’ radiation safety procedures and current

business practices can be readily adapted to meet the access controls.

B. IC 2: Monitoring, Detecting, Assessing, and Responding

1. Local Law Enforcement Agency (LLEA) Coordination

66. Could radiation detection meters, connected to a silent alarm, be used to alert

local law enforcement of an attempted theft of radioactive material?

Yes, radiation meters could be a means to detect theft of radioactive material depending on the

configuration of shielding surrounding the radioactive source. However, increased controls

were designed to provide a defense in depth strategy for the control of radioactive material in

quantities greater than or equal to Table 1 values and the NRC expects licensees to consider

all possible scenarios when developing and implementing a plan for the increased controls.

67. What if the LLEA declines to participate in the plan to respond to incidents due to

lack of staffing, resources, etc? 

Lack of cooperation by an LLEA, if it occurs, will be handled on a case-by-case basis.

68. Is the licensee required to keep the LLEA responders trained in radiation

protection?

In order to assure that the LLEA can appropriately determine the priority of its response they

need to have an understanding of the potential consequences associated with theft or sabotage

of the radioactive material of concern. For the LLEA to know how best to respond, they need to

know something about the potential hazards, and would therefore need to have some radiation

protection education. The training of your LLEA is suggested in guidance, but not required by

the Increased Control. The amount and frequency of radiation protection training needed is a

matter to be coordinated between the licensee and the LLEA.

69. Can you clarify what you mean by assistance from LLEA? For example, is a

single officer with radio backup sufficient or is an entire SWAT Team necessary? 

The LLEA will respond as appropriate to the event based on their understanding of the situation

and potential consequences. As indicated in the increased controls Implementing Guidance,

one of the purposes of establishing liaison with the LLEA is to provide them with an

understanding of the potential consequences associated with malevolent use of the radioactive

material of concern so that they can appropriately determine the priority of its response. The

LLEA response is needed for offsite coordination, in the protection of the public health and

safety, to mitigate potential consequences of malevolent use of radioactive material.

70. Does the required pre-arranged plan with the LLEA, (2.b. of enclosure 1) require

something beyond what is currently required of licensees?

The increased controls are an enhancement to current security requirements, and do not

relieve current security measures being undertaken by licensees, including LLEA coordination. 
-19-

Depending on each licensee’s existing measures, the increased controls may or may not

require additional action.

71. What information must be reported to what organization (NRC, Agreement State,

LLEA), and under what circumstances?

In response to the increased controls, you will be communicating with the NRC or Agreement

State regulatory agency, as appropriate, and coordinating with the LLEA. Reports shall be

made in accordance with ICs 2 and 3. This does not preclude you from making other reports

as required by other State or local laws. Information regarding your physical protection of

radioactive materials related to these increased controls can be given to the LLEA, without

violation of the information protection requirements in IC 6.

72. Does the NRC intend to require the responder to have firearms, or will non-lethal

weapons suffice? As an example, some security staff do not carry firearms and a

LLEA response might not meet the timeliness requirement.

The requirement for an armed response is not to prevent unauthorized access, but to respond

to and disrupt an actual or attempted theft, sabotage or diversion of radioactive material. 

Adversaries could be well armed individuals. A private security force does not substitute for a

LLEA. The LLEA will respond, as appropriate, to the event. 

73. Can an on-site proprietary professional security force with trained and armed

officers be considered as the LLEA?

An on-site armed force can serve as the initial licensee response. However, arrangements with

off-site LLEA shall still be established, and the off-site LLEA shall be notified immediately of

incidents, in case additional assistance is needed, and so that the LLEA can assess the

potential for off-site impacts and the need to notify other agencies.

74. With respect to dealing with the LLEA, is it the licensee's responsibility to make

arrangements with agencies beyond the local level?

It is the licensee’s responsibility to make arrangements with the LLEA that has responsibility for

response to potentially malevolent events. When coordinating with LLEA, licensees should use

this opportunity to also coordinate with the local Fire department. 

75. What coordination is required with the LLEA for work on temporary job sites?

The NRC expects that licensees would coordinate with their established LLEA point of contact,

who may be in the best position to communicate with another LLEA. Alternatively, licensees

may call 911.

76. Is there some method in place whereby the LLEA may become informed about

radioactive materials and our possession of such materials/devices?

The level of knowledge, experience and interest of LLEA will be varied. The Federal

government through the Department of Homeland Security (DHS) is actively working with LLEA

to improve their awareness and response across a wide field of threats by providing
-20-

information, training, and funds. In your coordination efforts with the LLEA, information you

provide will add to, and help reinforce, your LLEA’s knowledge regarding radioactive materials,

their use, and potential risk associated with its malevolent use. 

77. For a licensee who sets up a program with their LLEA, how do you handle

informing LLEA when you cross county or state lines when going to a temporary

job site?

IC 2.b only requires coordination with the LLEA for a pre-arranged plan to respond to an

incident at the licensee’s facility. Coordination with the LLEA in when crossing county or state

lines of jurisdiction is not required. However, for IC 2.a, licensees need to know how to, and

must request assistance from, the LLEA at temporary job sites. Licensees could coordinate

with their established LLEA point of contact, who may be in the best position to communicate

with another LLEA or to advise licensees on best practices. Alternatively, licensees may call

911. 

78. Should notification to the LLEA be made by a radiographer at a temporary job site

if a device is stolen from the temporary job site?

Yes. Licensees need to know how to request assistance from the LLEA at temporary job sites. 

Procedures following a theft at a temporary job site should be documented in your response

plan.

79. When contacting the LLEA, is it necessary to contact the Hazardous Materials

division? Would it be appropriate to give LLEA a diagram of my facility?

Each LLEA will assign the appropriate person or section to work with you. Depending an the

size of your facility and the location of the at-risk material providing a facility plan to LLEA may

be appropriate. The purpose of coordinating with the LLEA is to provide them with the

information they feel is necessary to do their job in responding to, potential malevolent acts

involving lost, stolen, or missing radioactive material quantities of concern from your facility.

80. Since facilities are also broken in to in order to obtain equipment other than

radioactive materials, do licensees need to notify the LLEA and the NRC

Operations Center or the Agreement State Regulatory Agency every time there is

a break in?

IC 2.a requires that the licensee’s response to any actual or attempted theft, sabotage, or

diversion of radioactive material quantities of concern or of the devices shall include requesting

assistance from the LLEA. IC 2.d requires licensees to notify the NRC Operations Center at

(301) 816-5100 or, for Agreement State licensees, the appropriate Agreement State regulatory

agency, after initiating appropriate response to any actual or attempted theft, sabotage, or

diversion of the radioactive material. So, the licensee’s decision whether to call the police and

the NRC or Agreement State, depends on what area the licenses determines needs to be

controlled for access to the radioactive material and its assessment of the unauthorized access. 

A licensee’s assessment and response to an intrusion alarm in the business office section of its

facility could be entirely different to its assessment and response to an intrusion alarm in the

radioactive materials storage area. 
-21-

81. Can LLEAs have access to the increased controls and licensee’s physical

protection information? What are the LLEAs responsibilities for protecting this

sensitive information?

LLEAs can have access to the increased controls and licensee’s physical protection information

if the licensee determines that they have a need for the information to conduct official business. 

State, local, or other law enforcement authorities are members of occupational groups deemed

to be trustworthy and reliable by virtue of their employment status and are used to handling law

enforcement sensitive information.

2. IC 2, Questions Specific to Portable and Mobile Devices

82. Does this mean all trucks will need an alarm system?

If the truck is left unattended with sources that meet the Increased Control’s criteria, licensees

must have a way to monitor and immediately detect, assess, and respond to actual or

attempted theft, sabotage, or diversion of the radioactive material or of the devices.

83. How do you handle a situation where you leave a camera at another licensee’s or

customers facility, one who provides security for their site (i.e. federal facility)

who is responsible for security? What about a client such as a refinery where you

leave a camera on site, who provides security there and how do we assess if

theirs is good enough?

Licensees who possess the radioactive material are responsible for the security and control of

their own material and need to meet the Increased Control requirements whether at their own or

a customer’s facility. If a licensee chooses to store devices at its customers’ facilities, they may

consider their customer’s physical protection program for meeting the intent of one or more of

the increased controls. There must be a clear understanding of the roles and responsibilities of

the licensee and its customer, and what features of the customer’s security and control program

are to be relied on to meet the increased controls. Licensees should assess the customer’s

security and control features being relied upon against its own program for implementing these

increased controls.

Particular attention should be given to IC 1 and limiting unescorted access to as few as possible

of the customer’s personnel and whether the customer has a process for determining

trustworthy and reliable individuals. The requirements for IC 2, to monitor and immediately

detect, assess, and respond to any actual or attempted theft, sabotage, or diversion of

radioactive material quantities of concern or of the devices, will also need to be satisfied. Clear

roles, responsibilities and methods need to be defined for communicating with the licensee,

assessing the incident, and summoning the appropriate responder including requesting

assistance from the LLEA.

84. Can you put an intrusion alarm system on a radiography truck? What about field

stations; who must meet the requirements for security and immediate detection?
-22-

Yes, an intrusion alarm system can be put on a radiography truck or any vehicle. The Licensee

and their authorized user has to meet the requirements of the increased controls at field

stations and at all off-site locations.

85. What about the cost for alarming all radiography trucks, temporary storage sites,

remote locations, etc? Aren’t these costs now prohibitive for licensees? Don’t

you think that you may damage the radiography industry by thrusting excessive,

and potentially costly security requirements upon them?

The NRC and Agreement States did consider costs and identified performance-based

increased controls that are effective but not cost prohibitive or overly burdensome. The NRC

and Agreement States consider that licensees are already implementing much of these

increased controls for radiation protection purposes and that existing practices and procedures

can be easily adapted for preventing and mitigating malevolent uses. The performance-based

approach gives licensees flexibility to develop effective programs tailored to the unique features

of each licensee’s facility and operations that can meet the intent of the increased controls.

3. Miscellaneous

86. Many of the devices are located in facilities that are staffed 24/7. Would increased

controls be required for such situations?

As discussed in the workshops, the licensee would still be required to implement the increased

controls but, the 24/7 staffing may be able to be taken credit for in meeting some of the

Increased Control requirements. Having staff that can challenge anyone clearly not having any

business near the device while at the same time being able to call for assistance should be

considered as part of the licensee response. 

87. What about a medical facility using personnel for monitoring where people are

moving about constantly and may not be watching the area under access

controls. How is this area maintained?

The licensee can use any number of methods. However, the method must meet the time

requirement identified in the Increased Control. The Increased Control requires that the

licensee respond immediately to any actual, or attempted theft, sabotage, or diversion of

radioactive material quantities of concern. An intrusion detection system linked to a monitoring

facility is one method of achieving compliance. However, the use of trained personnel can also

be implemented. The adequacy of a licensee’s method to comply with increased controls can

only be determined during an on-site inspection. No one method of access control and

monitoring may be right for all licensees.

88. Would implementation of an area monitor connected to a silent alarm, key-card

access to the area, and a video monitoring system be effective in meeting the

increased controls? 

The adequacy of a licensee’s method to comply with increased controls can only be determined

during an on-site inspection. The increased controls were created in a manner which will allow
-23-

licensees flexibility in choosing methods which work best when applied to their specific

circumstances. It is not only important to choose the appropriate method of monitoring,

detecting, and assessing but to assure that there is a dependable means in place to transmit

information between and among the various components used to detect and identify an

unauthorized intrusion, to inform the assessor, and to summon the appropriate responder. 

89. Does a licensee have to use an intrusion detection system linked to an on-site or

off-site monitoring facility? 

No. The licensee can use any number of methods. However, the method must meet the time

requirement identified in the increased controls. The Increased Control requires that the

licensee respond immediately to any actual, or attempted theft, sabotage, or diversion of

radioactive material. An intrusion detection system linked to a monitoring facility is one method

of achieving compliance. However, the use of trained personnel can also be implemented. The

adequacy of a licensee’s method to comply with increased controls can only be determined

during an on-site inspection.

90. Can IC 4 (physical barriers) be used to control access and prevent an unescorted

individual from entering the room where the radioactive source is located?

IC 4 is not primarily intended to provide access control but it can. IC 4 provides additional delay

in removing a portable or mobile device from the facility. For portable and mobile devices,

delay barriers are required in addition to the access controls required by IC 1. Without

additional delay barriers, a portable or mobile device could be removed from a facility before the

licensee has the ability to assess and respond to unauthorized access.

91. Can a less rigorous monitoring system be put in place during the routine workday

when trustworthy and reliable staff must secure the area and are not present for

direct surveillance?

Effective detection and monitoring can be accomplished in many different ways and tailored to

facility operations. Detection and monitoring requirements can be met through use of

personnel, electronic devices, or visual monitoring. Personnel would have to be determined to

be trustworthy and reliable, have a need to know, be trained in the security procedures, have

reliable communications, and be capable of meeting the immediate detection requirements. 

Electronic devices must be capable of alerting nearby trained facility personnel. Visual

monitoring must be capable of also alerting trained personnel.

92. Do licensees have to visually distinguish (e.g., badges) all individuals who have

not been granted unescorted access?

No, this is not a requirement. Colored badges may be appropriate for a larger organization,

while visual recognition may be appropriate in a smaller one. Using magnetic keys in place of

some form of visually distinguishing individuals would not be acceptable in terms of meeting the

intent of the increased controls implementing guidance. Magnetic keys control access, but do

not identify individuals.

93. How can licensees prevent those individuals who have criminal intentions from

gaining access to the radioactive material or device? 
-24-

The increased controls are not intended to stop determined adversaries, intent on malevolent

actions, from gaining access to the radioactive material. Rather, the increased controls provide

reasonable assurance that (1) individuals having unescorted access to the radioactive material

are trustworthy and reliable and (2) licensees have a reliable means to rapidly identify events of

potential malevolent nature and can have prompt police response to mitigate high

consequences. 

94. How can a single individual, such as a medical technologist assigned to be an

escort, be capable of preventing an incident or even raising an alarm in the event

that the unapproved individual is armed and intent upon malevolent use of

radioactive material in quantities greater than or equal to Table 1 values.

There may be no prevention for a well-thought out determined plan to gain unauthorized

access. The increased controls provide requirements to control access, monitor, detect,

assess, and respond. Each licensee may determine which methods will work the best for their

specific facility.

95. How do you protect against an insider threat?

The increased controls require that access to radioactive material in quantities greater than or

equal to Table 1 values be limited to only approved individuals. A licensee may grant

unescorted access to an individual, but may limit or restrict certain information concerning such

things as security system codes and other items regarding the physical protection of the

radioactive material. Access to vital information should be limited. This may not prevent a

determined insider. However, there should be an increased awareness among licensee staff to

report anything unusual or unexpected.

96. Should the radiation safety office/officer be involved in what can be viewed as a

security issue?

Although they may not be the experts in security issues, the radiation safety office/radiation

safety officer should be involved from the stand point that they provide valuable insight

regarding the radioactive material involved and potential safety significance. The radiation

safety office/radiation safety officer can provide coordination to ensure that all increased

controls are being implemented and not compromising safety.

97. What is an escort’s responsibility and should an escort perform body searches?

There are no specific requirements other than maintaining line of sight contact and any

assigned responsibilities under IC 2 or other safety duties. These procedures should be

tailored to each facility’s operations. Licensees should consider limiting the number of people

assigned to an escort so as not to decrease the escort’s effectiveness in completing other

assigned safety and security responsibilities. The overall goal is to control access to radioactive

material in quantities greater than or equal to Table 1 values and limit access to only approved

individuals who require access to perform their duties. Individuals who have not been approved

must be escorted.

98. Shouldn’t device features be considered or given credit for providing some

access control?
-25-

The increased controls were written with full awareness of the features of the device, as well as

the quantities of licensed material contained in the device. The increased controls were

designed to provide a defense in depth strategy for the protection of radioactive material in

quantities greater than or equal to Table 1 values. No single control can provide the same level

of protection as the combination of all the increased controls. Therefore, each of the increased

controls will have to be implemented.

99. Do well-logging sources or radiography sources get stolen as frequently as

gauges?

Information in the Nuclear Materials Event Database indicate that radiography sources are not

stolen as often as portable gauges.

100. Would the use of a security guard to periodically check areas to ensure they are

secure meet the requirement of “immediate detection?” Why would a 15 minute

response not be adequate for response to an alarm? Is there any other way to

monitor than to have an alarm system?

While trained individuals can be used to monitor, and immediately detect, assess, and respond

as required by the increased controls, periodic checks and/or a 15-minute response time by

individuals would not meet the immediate detection requirement. The increased controls were

created in a manner that will allow licensees flexibility in choosing methods that work best when

applied to their specific circumstances. It is not only important to choose the appropriate

method of monitoring, detection, and assessment, but to assure that there is a dependable

means in place to transmit information between and among the various components used to

detect and identify an unauthorized intrusion, to inform the assessor, and to summon the

appropriate responder. Trained individuals can be used to fulfill the requirements of the

increased controls, but licensee implementation must consider the need for implementation that

meets Increased Control requirements 24 hours per day, 7 days per week.

101. Couldn’t someone monitor cell phone communications, etc., in a licensee’s

communication plan for monitoring?

Yes. They could also monitor police radios. A dependable means to transmit information about

an unauthorized intrusion does not need to be a secure means of communication (i.e.,

encryption is not required). This is why backup communications (i.e., land line, auto dialers,

cellular phones, pagers, and radios) are required.

102. When someone reports a source lost or missing, what is the response of the NRC

or Agreement State?

Once an incident occurs, the licensee is expected to implement the appropriate elements of

their documented plan, pursuant to the increased controls. The NRC and Agreement States

monitor the situation to assure that appropriate actions are being taken to locate the missing

source. As required by the National Response Plan, the NRC notifies other Agencies and

coordinates Federal resources, if needed. Similarly, Agreement States would notify NRC and

other State Agencies and coordinate State resources if needed. In addition, the licensee is

responsible for reporting pursuant to 10 CFR 20.2201, or applicable Agreement State

regulation.
-26-

103. What is meant by assessment by automated devices?

Depending on the security system, layout of control areas, and sensors, automated devices or

systems may be programed to automatically summon LLEA assistance, in response to an

intrusion alarm, without having a licensee think through what the alarm may mean and deciding

whether to call the police. The assessment has been done in advance by the licensee with a

preset security system response to alarms from one or more detectors.

C. IC 3: Transportation Requirement

104. Does IC 3.a.1 apply to all modes of transportation?

IC 3.a.1 applies to domestic highway and rail shipments of radioactive materials of concern. 

Security during marine and air transport is covered by the U.S. Coast Guard Maritime

Transportation security regulations and the U.S. Transportation Security Administration security

regulations, respectively. The Increased Control has been revised accordingly.

105. How can the rules be fairly applied concerning transport, when a common carrier

 can transport without an alarm for immediate detection, versus when a licensee

carries a source and has to have an alarm, etc., to meet ICs 1 & 2?

As required by IC 3.a, a common carrier must use a package tracking system, assure

trustworthiness and reliability of their drivers, maintain constant control and/or surveillance and

have the ability to immediately summon a response. An alarm system is only one way to

maintain constant control and provide an immediate response.

106. The requirements of ICs 3.a and 3.b for use of common carriers appear to be less

stringent than ICs 1 and 2. Can licensees, who transport their own radioactive

materials opt to implement ICs 3.a and 3.b instead of ICs 1 and 2 for

transportation. 

No. Many licensees use their vehicles differently than common carriers and any differences in

the increased controls account for this while achieving the same objectives. While both the

NRC and the DOT have regulatory authority for radioactive materials, DOT [now also the DHS,

Transportation Security Administration (TSA)], has traditionally regulated the common carriers

of radioactive material. DOT regulations require certain carriers to have security plans, but do

not specify all the particular attributes of IC 3 for the security plan. The intent of IC 3 is for

licensees to use those carriers that have security plans, required by DOT regulations, that have

the particular attributes which achieve the same objectives as ICs 1 and 2. Because not all

carriers may be required at this time to have security plans, IC 3 allows flexibility for licensees

to choose any carrier that can meet the requirements of the Increased Control. The NRC,

DHS, TSA and DOT are working towards having seamless security of radioactive material in

quantities greater than or equal Table 1 values across the different regulatory jurisdictions, and

which is consistent with the International Atomic Energy Agency Code of Conduct on the Safety

and Security of Radioactive Sources.
-27-

107. Do shippers who hire Class A, etc., drivers have a trustworthiness and reliability

program in place? 

When licensees are “shippers” of radioactive material they must implement the requirements of

the NRC’s regulations, Security Orders, and increased controls. Common carriers employed by

“shippers” to transport hazardous materials must follow applicable DOT, TSA, and DHS

regulations. The security threat assessment required for a commercial drivers' license with a

hazardous materials endorsement, needed by common carriers, would satisfy the increased

control to assure the trustworthiness and reliability of drivers. 

108. Who will provide carrier information to licensees? Who is responsible?

Licensees are responsible for obtaining documentation from a carrier certifying that it can meet

and will implement the requirements of IC 3.a.

109. What do you do about carriers who subcontract work to other carriers who go to

locations that the original carrier does not travel to?

Licensees are responsible for obtaining documentation from a carrier certifying that it can meet

and will implement the requirements of IC 3.a., including work subcontracted to other carriers.

110. What if during the first 180 days you are unable to get information meeting the

Increased Control from the carrier, what do you do?

If a licensee is unable to work with a carrier to implement the requirements of IC 3.a for its

shipment or is unable to find another carrier in time, then the licensee will need to notify the

NRC or Agreement State, as applicable, and seek relief from the specific requirement. The

request shall provide the licensee’s justification for seeking relief from or variation of any

specific requirement, a proposal for achieving the same objective, or a schedule for achieving

compliance. Documentation from a carrier need not be obtained within the 180 day

implementation period, but would be needed by the time the shipment is made.

111. Licensees should not be responsible for the internal security program of private

carriers. How do I verify and document that a carrier employs the appropriate

security measures?

Licensees do not have to inspect carriers’ security programs to verify the security measures. 

Licensees need only obtain documentation from the carrier that attests to the fact that its

security plan meets the requirements off the applicable IC 3.a and contains a commitment that

those requirements will be applied to the licensee’s shipment.

112. What do we do if our contract carriers do not meet the criteria in the increased

controls?

You would not be able to use them to transport sources under the increased controls. By

working with the industry and the carriers, the NRC and Agreement States expect “qualified”

carriers to indicate that they meet the criteria of the increased controls.
-28-

113. Will the NRC develop an accreditation process or provide an “approved” list of

those carriers that meet the requirements of IC 3.a?

The NRC does not intend to establish such a program nor can it recommend companies to

perform services. However, licensees and industry groups may develop a system for

identifying and certifying carriers that meet the requirements of the increased controls and then

share that certifying documentation with group members or customers. 

114. Why isn’t the DOT inspecting the carriers security plans instead of having

licensees having to assure that carrier’s security plans meet the requirements of

49 CFR 172 Subpart I?

The DOT does verify through inspection that carriers have security plans in accordance with

49 CFR 172 Subpart I. However, the security plan requirement may not apply to all carriers. 

Furthermore the attributes specified in IC 3.a are not all specifically identified in DOT’s

regulations and therefore, may not be included in all carriers’ security plans. The Increased

Control allows licensees the flexibility of approving the use of carriers that may not be required

to have a DOT security plan, but can apply the attributes specified in the Increased Control for

a licensees shipment.

115. Which licensee is responsible for investigating and reporting the loss of

radioactive material in transit, the shipping licensee or the receiving licensee?

As required by IC 3.a, the shipping licensee that is transferring and arranging the shipment of

radioactive material to another licensee is responsible for initiating an investigation with the

carrier if the radioactive material does not arrive by the pre-arranged expected time of delivery. 

If the carrier can not locate the shipment and ascertain that it still has control over the

radioactive material within the prescribed period, then the shipping licensee must report the

missing shipment of radioactive material. As required by IC 3.d, the licensee receiving

radioactive material needs to coordinate with the supplier to know when to expect the delivery

to assure security when it arrives. Although the shipping licensee is responsible for seeing that

the radioactive material gets to its destination in a timely fashion, the receiving licensee must

coordinate with the shipping licensee to have an understanding of what notifications, if any, the

shipping licensee needs. The NRC expects a clear understanding between the shipping and

receiving licensees to assure the successful and timely transfer of radioactive material.

116. For IC 3.b, why can’t the NRC issue Orders now to cover the shipment of

radioactive materials greater that 100 times the quantities in Table 1, instead of

waiting until 90 days before a shipment to notify the NRC? Alternatively, why

can’t the NRC require licensees to identify whether they are likely to meet that

threshold in their response to the proposed increased controls. 

The NRC has a separate Order for additional security measures for the transportation of

Radioactive Material Quantities of Concern (RAM QC). The ASMs are Safeguards Information

- Modified Handling (SGI-M) and have limited distribution to those licensees that are likely to

ship radioactive material in quantities greater than 100 times the quantities in Table 1 (i.e.,

licensees that have a need to know). Although this group of licensees may possess RAM QC

quantities, stakeholder feedback at the workshops indicated that they are more likely to be the

recipients of these quantities of material rather that shippers. Stakeholders also indicated that
-29-

M&D licensees who will be implementing the RAM QC Order are more than likely the ones that

will be making the return shipment of this material for their customers. Therefore, the RAM QC

ASM Order will only be provided to those licensees in this group who have a demonstrated

need to know based on the 90-day advanced notification of a need to ship such quantities.

117. For IC 3.b, which licensee is responsible for notifying the NRC 90 days prior to

shipment radioactive material greater the 100 times the quantities in Table 1, the

shipping licensee or the receiving licensee?

The shipping licensee that is transferring and arranging the shipment of radioactive material to

another licensee (receiving licensee) is responsible for notifying the NRC 90 days before an

expected shipment, unless the licensee is already implementing the ASM Order for the RAM

QC. The RAM QC ASM Order is to be implemented by January 2006.

118. Is IC 3 applicable when I transfer a source or device to a different building?

Whenever radioactive material in quantities greater than or equal to Table 1 values is being

transferred, the shipment must comply with applicable Increased Control requirements. If the

transfer is accomplished within the licensee’s controlled area, the movement of the radioactive

material is not exempt from the increased controls. IC 3 applies if the licensed radioactive

material is being transferred from one licensee to another and the shipment is made by a

common carrier by road or rail. A new building or an interim location must also have the

security required by the increased controls.

119. We have a great deal of trouble tracking our sources when they are “clearing

Customs.” We have been unable to get information regarding any type of

tracking system that U.S. Customs may be using. Will the NRC provide us with

assistance in dealing with U.S. Customs with regard to tracking our sources once

they are in the domain of Customs?

The increased controls are not intended to require tracking of sources through Customs. IC 3

only requires the use of carriers that implement a package tracking system. Licensees may

consider the sources to be secure while going through the Customs process. The NRC, in

developing a National Source Tracking System, interacts with the DHS, Customs and Border

Protection and will pass on this concern.

120. Are source manufacturers, including radiography source manufacturers,

responsible for, and must they comply with, the increased controls when

shipping sources to licensees like me?

Yes. When M&D Licensees are shippers of radioactive material they must implement the

requirements of the NRC’s Order for ASMs dated January 12, 2004. 

121. Are notifications of shipments not received when expected treated as Sensitive

Unclassified Information that is NOT publicly disclosed? If a licensee calls the

NRC Operations center, will that not be entered as an Event Notice and be made

public?

The NRC is considering whether to make this type of information publicly available.
-30-

122. Do you need package design changes to approved DOT transport containers so

that you can secure them to a truck, given that at present you can not modify

these containers if you want to be in compliance with DOT requirements?

Yes modifications to a DOT or NRC transportation package design need to be approved by the

competent authority. Security and safety should complement each other. Security should not

interfere with safety.

D. IC 4: Physical Barriers for Portable and Mobile Devices

123. If sources are stored in one room, does that mean aggregate quantities?

Footnote 3 to Table 1 provides that radioactive materials are to be considered aggregated or

collocated if breaching a common physical security barrier (e.g., a locked door at the entrance

to a storage room) would allow access to the radioactive material or devices containing the

radioactive material.

124. Can 1/8 inch wire cables be used to secure a radiography camera instead of

chains? Is the lock then more of a vulnerability than the cable?

A heavy-duty twisted steel wire cable may be used to secure portable and mobile devices. 

Ideally the wire should be such that it can only be removed with a heavy duty cable cutter (e.g.,

thickness greater that a No. 10 wire - 1/8 inch or 2 mm). Any system is only as effective as its

weakest component therefore other components of the securing mechanism need to have

similar strength such that it would require a heavy duty bolt cutter for removal (Typically, Tensile

Force: 2,000 lbf and Shackle cutting force test: 4,000 lbf). Regulatory Guide 5.12 “General Use

of Locks in the Protection and control of Facilities and Special Nuclear Materials” may provide

some useful information. Other references include: NUREG/CR-5929, Locking Systems for

Physical Protection and Control; NUREG-0274, part 5, Catalog of Physical Protection

Equipment, book 2, Volume III, Entry Control Components; Army Regulation 190-11, Physical

Security of Arms, Ammunition and Explosives; and Department of Energy (DOE) M 5632.1C-1,

Manual for Protection and Control of Safeguards and Security Interests. 

125. If you lock a radiographic camera in a trailer at a job site, and the source is locked

in side the trailer, how do you secure the trailer?

How a trailer could be immobilized or secured to add a delay factor would depend on the size of

the trailer and its location. This may be accomplished by a variety of physical controls

including: protective storage enclosures, trailer hitch locks, wheel locks, hardened chain and

lock, removing the wheels, or deflating the tires.

E. IC 5: Documentation and Document Retention
-31-

126. When a device/source is removed from a license (or when a licensee falls below

greater-than Table 1 quantities) may the licensee destroy or transfer to the NRC

the security documentation required by IC 5?

No, the licensee is required to maintain documentation for three years after the quantity of

radioactive material falls below the Table 1 threshold criteria. At that time, all security

documentation should be appropriately destroyed. No transfer of documentation to the NRC is

necessary.

127. If records retention are for a lifetime, why can’t they be three years to be in line

with other NRC requirements?

IC 5 has been revised to read: The licensee shall retain documentation required by these

increased controls for three years after they are no longer effective.

128. Can the records be kept in Human Resources or do they have to be kept in

Radiation Safety?

The review and/or record storage can be delegated to Human Resources or any other

appropriate department depending on your organization. Additionally, the process used and

the information previously obtained through the hiring process or another background check

process may be used to support a trustworthy and reliable finding without having to re-verify the

information. However, the individual responsible for the background checks must document the

basis for concluding that individuals are trustworthy and reliable. The documentation may

reference pre-existing records.

F. IC 6: Information Protection

129. Will we be handling Safeguards Information?

No, the increased controls are not Safeguards Information 

130. Does the Commission understand that making certain documents Safeguards

(SGI ) or Safeguard Information - Modified Handling (SGI-M) would cause

difficulties for the well-logging industry, particularly at remote temporary job

sites.

Yes, the Commission and the NRC staff took this into consideration when they designed the

increased controls. The increased controls are not SGI or SGI-M. Measures to protect

information are to be taken by the licensee for all information generated by the licensee in

response to the increased controls including licensee’s plans and procedures for the physical

protection of the radioactive material covered under these increased controls. Such handling

procedures are similar to measures used in managing company proprietary, confidential

commercial, or financial information, personal identification information, and individual financial

information. 
-32-

131. How does a licensee determine what material is Safeguards Information (SGI ) or

Safeguard Information - Modified Handling (SGI-M)? Overall, the Security

Classification system seems burdensome.

There are no SGI or SGI-M documents associated with these increased controls. Information

generated by licensees in response to the increased controls will not be considered SGI or SGIM. However, the plans and procedures related to a licensees physical protection, of these

radioactive materials, is sensitive information and must be protected from unauthorized

disclosure.

132. Are we going to be required to provide workers with copies of sensitive

information such as that contained in security procedures, etc? Do Licensees

have to provide employees with copies of the increased controls?

Copies of the increased controls will be publicly available, and can be provided to employees. 

In accordance with the increased controls, sensitive information generated by the licensee,

about its physical protection of the radioactive material (including policies, plans and procedures

for these increased controls), must be limited to employees who have a “need-to-know” such

information to perform their duties and who are considered trustworthy and reliable.

133. Do the restrictions on disclosure apply to DHS, Federal Bureau of Investigation

(FBI), Central Intelligence Agency (CIA), etc.? Can we share increased controls

and associated information with other entities such as a LLEA and feel safe that

it’s protected?

The increased controls will be made available to the public-at-large. Licensees will need to

share some of its sensitive information with some of these agencies and LLEA as part of the

coordination required for your response plan. As government employees and law enforcement

officers, they have been determined to be “trustworthy and reliable.” The licensee will need to

determine if they have an official need to know. 

134. Will the increased controls and/or its recipients be made public?

The increased controls will be made publicly available, however, the lists of licensees receiving

the increased controls is sensitive information and will not be disclosed to the public. 

135. Can we share increased controls with governmental agencies who inspect us and

with contractors who will support us in our efforts?

Yes. The increased controls will be made publicly available and may be shared with these

entities.

136. Will the NRC provide guidance for licensees on how to share Order information

to their clients, carriers and others?

Yes. Guidance is provided to licensees for the handling of sensitive information that pertains to

your physical protection of the radioactive material (including policies, plans and procedures

related to these increased controls). Sharing sensitive information with clients, carriers and

others is on a need to know basis. The information needs to be protected the same way a
-33-

licensee protects its own security, confidential, commercial, or financial information and

revealed only to those persons who must have the information to conduct business.

137. What potential liability lies with the licensee in regard to safeguarding this

information? Are there significant costs involved?

The licensee’s physical protection information does not need to be treated as safeguards

information, but it is sensitive physical protection information that needs to be protected. 

Violation of information protection requirements would subject licensees to traditional

enforcement action, which could include civil and/or criminal penalties. Costs involved in

protecting this information are expected to be minimal in that protecting the material when not in

use requires it be kept in a locked cabinet or desk.

138. Will Agreement State radiation control programs have to change their procedures

regarding information collection and document availability for Part 35 and other

licensees of concern to ensure this information is not made readily available to

interested parties without a need-to-know?

Agreement States generally have processes and procedures for withholding sensitive

information from the public. The NRC is working with the Agreement States to ensure that all

sensitive information relating to materials licensees (including licensees’ information about the

physical protection of radioactive materials) be withheld from public disclosure.

139. The preface to the NRC transmission of draft documents which contains the text:

“The U.S. Nuclear Regulatory Commission (NRC) considers that any information

that could be useful, or could reasonably be expected to be useful, to a terrorist in

a potential attack should be withheld from public disclosure” is overly broad. 

Can you be more specific?

The intent and objectives of the increased controls are to enhance existing security

requirements to reduce the risk for the malevolent use of radioactive material in quantities

greater than or equal to Table 1 values. Reducing the access to and release of sensitive

information supports this goal by adding an additional level of protection. The NRC and

Agreement States determined that a “defense in depth” strategy providing multiple layers of

security is the best approach to protecting radioactive material quantities of concern.

140. All of the regulatory agencies should reach consensus on what information

should be protected, reduce the number of classifications, and develop a single

set of document security protection standards.

The NRC has worked collaboratively with other federal and States agencies on information

protection issues. While consensus has been reached on many issues, consensus on

protection standards for sensitive information has not been reached. When submitting sensitive

information to your regulatory agencies, the NRC expects that NRC licensees follow the

recommended procedures for protecting material as described in 10 CFR 2.390 and Agreement

State licensees should follow applicable State regulations. All licensees must follow the

requirement in the increase controls to develop, maintain, and implement policies and

procedures for the proper handling and protection of licensee generated information related to

physical protection of radioactive material to avoid unauthorized disclosure.
-34-

141. If security requirements move to rulemaking and are published, how will you

control sensitive information? 

The NRC anticipates that rulemaking will provide the performance based security requirements

and not include sensitive information that must not be publicly available. Specific licensees’

measures for the physical protection of radioactive material will be protected information. (e.g.,

see 10 CFR Part 73 as an example).

III. Inspections: Inspection Process and Agreement State

Involvement 

A. Inspection Process and Agreement State Involvement

142. How will the NRC ensure consistency in the inspection process?

The NRC and Agreement State inspectors are aware of the intent of the increased controls and

are receiving training to ascertain whether licensees meet the objectives of the increased

controls. The inspections are guided by inspection procedures. There will be a process

established to help ensure consistency in the inspection processes.

143. Will the inspection criteria and other guidance be available to the licensees?

Yes. Licensees will be provided informational copies of the Temporary Instruction (TI) for

inspection when it is complete. TIs provide inspection guidance to NRC and Agreement State

inspectors.

144. Are inspections announced?

The Initial Inspections for implementation conducted for these increased controls will be

announced.

145. Are civilian contractors going to perform inspections?

At this time, there are no plans to contract out inspections.

146. Can the security inspections be performed at the same time as routine

inspections?

Yes, initial inspections may be done when inspectors are onsite for a safety inspection. 

147. Does early compliance subject you to an early inspection? And if inspected

before the 180 days is up, are you subject to penalties if found to be in

noncompliance or do you have the full 180 days to fix the problems?
-35-

No to both questions. Initial inspections will not begin until after the 180-day implementation

period. Early compliance is an advantage to licensees allowing them to self-evaluate their new

procedures prior to inspection.

148. Is there more inspector training coming? Can licensees attend the inspector

training or will NRC provide some other type of equivalent training?

NRC will provide training for both NRC and Agreement State inspectors. The training course is

designed for inspectors. Licensees will be provided with a copy of the Temporary Instruction.

B. Agreement State Inspections

149. Agreement states are different, in that one has different “added” requirements in

their respective states. Are the inspections going to be different as in the

differences between states or will they be uniform?

The NRC is implementing measures to facilitate uniform inspection and enforcement for all

licensees. NRC and State Inspectors will receive the same training. Inspectors are required to

follow a Temporary Instruction developed for inspecting the requirements of the increased

controls. Bi-monthly teleconferences with NRC and State officials are anticipated to provide an

avenue to discuss findings and issues to help ensure consistency in the nationwide

implementation.

150. Is the enforcement process any different from what we are used to under the

Agreement State?

No. Agreement States will use their existing enforcement processes. The NRC enforcement

policy is available for your review on the NRC public website at www.nrc.gov/what-wedo/regulatory/enforcement. Bi-monthly teleconferences with NRC and State officials are

anticipated to provide an avenue to discuss findings and issues to help ensure consistency in

the nationwide implementation. The Integrated Materials Performance Evaluation Program

(IMPEP) procedures will be revised to assess program implementation

151. Can an Agreement State cross state lines and inspect in another state?

Agreement State inspectors perform the security inspections for the licensees in their state. 

One situation that may arise would be if a State inspector needed to inspect records of its

licensee that are kept at a corporate office located in another state. In the case where a

corporate office maintained records for licenses is several states, NRC would try to coordinate a

consolidated inspection.

152. Are there going to be inspection fees for the increased controls inspections?

NRC will not charge its Licensees a fee for the initial inspection for compliance with the

increased controls. It will be up to each Agreement State to determine whether to charge a fee

for the initial inspections. It is anticipated that the majority of inspections could be

accomplished during routine health and safety inspections, minimizing the need for special

inspections. 
-36-

153. Are states going to be involved in the Security Findings Review Panel (SFRP)

process?

No. As an alternative to the SFRP process, bi-monthly teleconferences with NRC and State

officials are anticipated to provide an avenue to discuss findings and issues to help ensure

consistency in the nationwide implementation. 

IV. Definitions

154. What is meant by “access” and “physical control”?

A person has access and physical control when they are able to touch the radioactive material

in quantities greater than or equal to Table 1 values or any device which contains such material. 

The licensee is expected to maintain control of such radioactive material at all times by

appropriate means that fit their operations. This includes utilizing escorts for those individuals

who may be in the area but do not have a need to use the radioactive material or the devices it

is contained in.

155. What is meant by “immediately”?

Immediately means to initiate response without delay. It is recognized that time may be

required to make an assessment of the scope of the problem and to respond to the

unauthorized access to radioactive material quantities of concern. 

156. What is meant by “sabotage” of radioactive material in quantities greater than or

equal to Table 1 values? 

The NRC and Agreement States are highly concerned with those activities that could lead to

any malevolent use of radioactive material, including sabotage, which would include

manipulation or rigging of the device or of the radioactive material quantities of concern, in

place, with the intended outcome of causing harm. Accordingly, the increased controls have

been designed to mitigate both the potential for theft and the intentional misuse of radioactive

material, resulting in detrimental consequences to public health and safety.

157. What is meant by “constant surveillance” and how must it be maintained?

A licensee can achieve constant surveillance by continuously monitoring the radioactive

material quantities of concern or the device it is housed in. This can be carried out through the

use of personnel and/or mechanical means. Physical detection and monitoring requirements

can be met through the use of personnel who have been approved for unescorted access. 

Personnel would have to be trained in the security procedures, have reliable communications,

and meet the immediate detection requirements.

158. Combining the definitions of mobile equipment, portable equipment and

stationary equipment makes no sense and is confusing. In addition the word

device may have a different meaning to the NRC than it does to the licensees. For

example, does a lead “pig” or a transport container fall into the category of a

device?
-37-

IC 4 has been revised to make a clearer distinction between the requirements for portable and

mobile devices.

“Device” can have different meanings to the various types of licensees that possess sources

containing radioactive material quantities of concern. In the context of the increased controls it

is used in a generic sense to mean an approved device to safely contain radioactivity under the

conditions of their possession and use. Devices may include but are not limited to the following

examples: Self-shielded irradiators, blood irradiators, remote afterloaders, teletherapy units,

gamma stereotactic radiosurgery units, radiography cameras, source changers, well logging

equipment, radioisotope thermoelectric generators, gauges or controllers, storage containers,

and lead “pigs” or transportation packages.

159. If a piece of equipment can be hand-carried by two or three individuals is it

considered a portable device?

Definitions from the American National Standard for Gamma Radiography - Specifications for

Design and Testing Apparatus, ANSI N43.9-1991, provides some guidance: 

Portable: “A portable ... device, designed to be carried by one person alone. The

mass of a ... device should not exceed 35 kg (77 lb).”

Mobile: “A mobile, but not portable, ...device, designed to be moved easily by a

suitable means provided for the purpose.”

In general, however, to address IC 4, the licensee shall utilize two independent physical

controls forming tangible barriers to limit ease of theft by an adversary or adversaries, of a

device containing radioactive material quantities of concern and considered removable.

V. General

A. Service Providers and Manufacturers and Distributors (M&Ds)

160. Should the NRC focus its security efforts on vendors who supply and replace

sources?

The NRC has focused on these groups, the Manufacturing and Distribution (M&D) Licensees,

as they have already been issued Orders which focus on a higher level of security than these

increased controls.

161. It is our opinion that engineering controls are much more reliable than trying to

predict an individual's current or future "trustworthiness or reliability." Should

the increased controls result in maximizing licensee reliance on engineering

controls?

The increased controls provide a defense in depth strategy. The increased controls do not

prohibit the use of engineering controls to meet the intent of some of the increased controls. 

However, the degree to which engineering controls are implemented is a licensee’s business

decision. Note: if licensees consider instituting engineering controls, those controls should not
-38-

modify the actual device as described in the sealed source/device registration sheet.

162. Should the NRC require M&D licensees to make design changes that make the

radioactive sources less accessible or retrofit an anti-theft device or engineering

controls into each device to prevent quick removal? 

No. Not at this time. The increased controls require the licensee to limit access to radioactive

material quantities of concern. It is up to the licensee to determine how to make this limitation;

either by way of engineering controls around the source itself or by limiting access to the

area/room where the radioactive material is stored/used. However, an approach to make

design changes to devices in lieu of increased controls would require licensees to either

purchase new equipment or retrofit existing devices. Engineering controls such as an anti-theft

device are options for the M&Ds of such devices to consider, but the NRC has not mandated

this requirement. The NRC’s Office of Nuclear Regulatory Research is pursuing design

enhancements to make sources less dispersible.

163. Please provide information gathered during security assessments so that M&Ds

can make necessary modifications. Some devices require the removal of a

significant amount of shielding/housing in order to gain access to the radioactive

material. Does this type of configuration constitute a source containing

radioactive material quantities of concern?

The specific results of security/vulnerability studies are not being released. However, those

studies indicate that these device source combinations may be vulnerable under certain

scenarios. The increased controls provide the additional security deemed necessary. A

number of factors were considered when creating the increased controls including the

International Atomic Energy Agency’s Code of Conduct which specifically lists the activity and

isotopes which constitute a source containing radioactive material quantities of concern.

164. There are differences in the requirements for the determination of trustworthiness

and reliability in the M&D licensee Order and the increased controls for other

licensed users. Is there or will there be a move towards standardization in the

requirements?

The NRC and Agreement States have taken a risk informed approach in determining

appropriate increased controls for the various types of licensees.

165. Should the NRC have the three radiography source suppliers develop

trustworthiness and reliability information on delivery personnel and provide it to

the licensees?

The M&D licensees are implementing the NRC’s Order for ASMs dated January 12, 2004. This

Order has a trustworthiness and reliability component. If a licensee wants to grant unescorted

access to M&D licensee’s delivery or service personnel, then documentation may be requested

from the M&D licensee attesting the trustworthiness and reliability of an individual has been

determined in accordance with the January 12, 2004, M&D Licensee Order.

B. Medical Facilities
-39-

166. How will the thresholds identified in the quantities of concern affect High Dose

Afterloaders (HDR), especially mobile units?

Most single HDRs do not exceed the thresholds and therefore increased controls are not

required if the devices are not collocated. However, for source change outs or in other cases

where there are two or more collocated sources, the increased controls need to be

implemented. 

167. Many of the devices such as a gamma knife or blood irradiator are inherently hard

to steal because the sources are hard to get at and the devices are very heavy. 

Why do we have to consider additional increased controls for these devices?

Studies by national laboratories indicate that the sources in those devices are vulnerable under

certain scenarios. As such, the increased controls developed were determined to be

reasonable and provide the additional security deemed necessary.

C. Agreement State Licensee Concerns

168. Are the Agreement States allowed to impose stricter requirements?

The NRC and Agreement States worked cooperatively in developing these increased controls. 

The Organization of Agreement States and the Conference of Radiation Control Program

Directors, Inc. were represented on the Materials Security Working Group and Steering

Committee. The requirement for implementing these increased controls is being issued by both

NRC and the Agreement States to protect the public health and safety. To affect nationwide

implementation, these measures have been determined by the Commission to be an matter of

compatibility Category "B" for Agreement States. In parallel with the Commission issuing

Orders to its Licensees, each Agreement State is issuing legally binding requirements to put

similar measures in place for licensees under their regulatory jurisdiction.

169. Will a licensee who only holds a State license only correspond with the State or

will they correspond with the NRC also? 

Licensees’ responses go directly to the NRC or Agreement State licensing agency issuing the

requirement to implement the increase controls. 

170. Is there any chance that the NRC will take back the Agreements from the

Agreement States because of all the security measures being implemented? Is

this the first step towards everyone having an NRC license?

No, the NRC is not considering “taking back” Agreements as a result of requirements to

implement these Increase controls. 
-40-

D. Miscellaneous

171. How are the NRC and Agreement States ensuring that the appropriate licensees

receive the increased controls?

The NRC and Agreement States use their licensing databases to determine which licensees

should receive these increased controls. If States or other licensees are aware of licensees

that should receive these increased controls but have not, they should contact their Agreement

State licensing authority or the NRC’s Office of Nuclear Material Safety and Safeguards.

172. If one licensee who owns material and transfers it to another licensed individual,

with the intent that the original transferor gets it back, is the transferee

responsible for security while they have it in their possession? 

Yes. NRC or Agreement State licensees must provide security for licensed radioactive material

they possess under their license (see 10 CFR §20.1801 and §20.1802) whether or not they own

the radioactive material (e.g., many licensee possess Department of Energy owned material).

173. Who is responsible for security if an “off-site” licensee brings its own radioactive

materials to use at another licensee’s facility?

With respect to radioactive material in quantities greater than or equal to Table 1 values

brought to a licensee’s facility by an "off-site licensee," the responsibility for security will depend

on the purpose and status of the material being brought on-site. If the material, such as a

radiography source, is brought onsite by another licensee for the purpose of that off-site

licensee performing its licensed functions (in this example, industrial radiography) at a

"temporary job-site," the security of the material is the responsibility of the off-site licensee. If

the material is being brought on-site for the purpose of being transferred to the licensee, then

the responsibility for security belongs to the transferee (i.e., the licensee), upon delivery of the

material.

174. On remote sites, sources stored in lead “pigs” are typically left unattended for

periods of time. Will this practice still be acceptable under the increased

controls?

No. Under current regulations, this practice is not acceptable. The regulations, 10 CFR

§20.1801 Security of stored material, requires: “The licensee shall secure from unauthorized

removal or access licensed materials that are stored in controlled or unrestricted areas,” and §

20.1802 Control of material not in storage requires: “The licensee shall control and maintain

constant surveillance of licensed material that is in a controlled or unrestricted area and that is

not in storage.” 

175. Is there any possibility that NRC is going to modify 10 CFR Part 34 to require two

qualified individuals to transport radiography cameras?

At this time the NRC does not have any plans for such a proposed rulemaking. 
-41-

176. At what point does a service provider, who takes temporary possession of

radioactive material for service or installing it into a device, transfer responsibility

for security of the radioactive material back to the facility licensee?

Licensees under requirements to implement the increased controls are responsible for security

at its facility whether or not a service provider takes temporary possession while working with

the licensee’s radioactive material. A service provider, when taking temporary possession of its

customer’s radioactive material, takes responsibility for implementing radiation safety

requirements while working with the customer’s radioactive material or device containing the

radioactive material. A service provider, when in temporary possession of radioactive material

for radiation safety purposes, is not responsible for implementing the requirements of the

increased controls related to its customer’s radioactive material.

177. Can the NRC sensitive information be communicated to a single, centralized

location for licensees that conduct business in multiple states?

If requested in writing, the NRC can communicate sensitive information to a single,

appropriately identified, licensee-designated contact.

178. How does the NRC determine to whom the increased controls and related

materials are sent for, at a licensed facility?

The NRC and Agreement States send the information to the licensee’s designated "contact

person" (as provided in the licensee’s application). The licensee has a responsibility, based on

a "need-to-know," to make a determination as to which individuals in their organization should

be provided copies of the increased controls. 

179. Can the increased controls be sent via overnight delivery, with conspicuous

markings to indicate their importance and the requirement for a response?

NRC will send the increased controls to licensees via overnight delivery; however, the NRC will

not include conspicuous markings regarding licensee response requirements. During the last

few years, the NRC has received responses to Orders and other regulatory actions, and to

date, has not observed difficulties by its licensees in responding to these special transmittals. 

Agreements States will each determine the best method to send the requirements to implement

the increased controls to its licensees.

180. Can the delivery of the increased controls be timed so they do not arrive during

major professional meetings?

The NRC and Agreement States will consider the timing of the increased control issuance in

light of special events, such as national holidays and major professional meetings, affecting the

regulated community.

181. Is the DHS aware of the NRC activities concerning radioactive materials?

The NRC maintains an ongoing relationship with several governmental agencies (e.g., DOT,

Department of Defense, DHS, Department of Energy) to ensure coordination and consistency
-42-

in overlapping areas of responsibility and enforcement.

182. Has the NRC coordinated with other federal agencies to promote consistency of

security measures?

Yes. The NRC is working collaboratively on security issues, including enhancement to nuclear

materials security, in efforts to assure security measures are effective and reasonably

consistent with other State and Federal agency actions. The NRC continues to work with DHS

and other Federal agencies to integrate Federal Response Plans into a unified National

Response Plan and National Incident Management System, and to refine the National

Preparedness Policy. 

In addition, the NRC has ongoing discussions with Federal agencies, including DOT and DHS,

in developing an integrated federal approach for radioactive materials security measures. The

NRC is also working in conjunction with the State Department and the international

communities to harmonize all regulations associated with the safety and security of radioactive

sources.

183. What is the overall intent and objective of the increased controls?

The intent and objective of the increased controls is to enhance existing security and control

requirements to reduce the risk of malevolent use of radioactive material quantities of concern. 

The increased controls cannot prevent 100% of all attempts at theft, sabotage or diversion;

however, in total, the increased controls provide multiple layers of control, or a “defense in

depth,” that are designed to provide enhancements to mitigate the risk of malevolent uses.

184. Are you more concerned with theft or sabotage-in-place of radioactive material

quantities of concern?

The NRC and Agreement States are concerned with those activities that could lead to any

malevolent use of radioactive material. Accordingly, the increased controls have been primarily

designed to mitigate against theft, but also provide appropriate protection against sabotage-inplace of radioactive material, resulting in detrimental consequences to public health and safety .

185. What is the basis for the Table 1 quantities of concern identified in the increased

controls?

The NRC and Agreement States adopted the IAEA Code of Conduct Category 2 threshold

quantities as the basis for the increased controls to allow consistency between domestic and

international efforts for security of radioactive materials that are deemed to be attractive targets

for malevolent use. The IAEA process uses the international units of Terabequerels (TBq) and

as such, the NRC is using the TBq values as the regulatory standard. The decision to adopt

these quantities was supported by earlier NRC and DOE analyses.

186. The expression of Curie (Ci) values to one significant digit might be considered

insufficiently precise. Also, the regulated community, that still works largely in Ci

units, might not readily identify the distinction in Footnote 2 to Table 1, that "TBq

values are the regulatory standard and Curie values are rounded to one

significant figure and are provided for informational purposes only." Can Table 1
-43-

be revised to provide Ci values to two or more significant figures so that it would

not be so easily misinterpreted, misapplied, or the cause of potential violations?

Curie values are provided for informational purposes only, since the values have been rounded

after conversion. Any conversion to the curie must still meet the TBq limit. From a scientific

perspective, the radionuclide thresholds in the IAEA Code of Conduct are quoted to one

significant figures in recognition of the limitations on the accuracy of the modeling. However,

Table 1 has been revised to provide curie values with two significant figures, for licensee’s

convenience and to facilitate consistency in the enforcement area and in other aspects of

NRC’s and Agreement States’ regulatory programs. 

187. The Table 1 Quantity of Concern for Am-241 and Am-241:Be is 0.6 TBq (20 Ci). 

That is a problem for the oil and gas industry. In addition, there seems to be a

discrepancy between Table 1 and page 15 of the Code of Conduct which lists well

logging as a category 3 source/activity. Is there any way that the threshold for

Am-241 and Am-241:Be can be raised? Or can alternative criteria for meeting the

goal of the increased controls be determined for remote temporary job sites (i.e.,

offshore rigs, and the north slope).

There is no discrepancy between Table 1: Radionuclides of Concern and page 15 of the

International Atomic Energy Agency (IAEA) Code of Conduct. Although the Code of Conduct

describes Category 3 sources as “typically used in practices such as.... well logging,” IAEA

TECDOC-1344, “Categorization of Radioactive Sources,” which was the basis for the Code of

Conduct, lists Am-241 well logging sources as having a range of activity from 0.019 TBq

(Category 4) to 0.85 TBq (Category 2). The IAEA Category 2 threshold quantity for Am-241 is

0.6 Tbq (16 Ci). The IAEA threshold quantities for Category 2 sources are the bases for Table

1 radionuclides and values. The U.S. Government is committed to implementing the IAEA

Code of Conduct. Any changes in the threshold quantities will have to be accomplished

through the IAEA process. The NRC and Agreement States will consider suggestions from

industry on alternative methods for achieving the objectives of the increased controls.

188. Was the potential financial impact of the increased controls considered?

The cost of implementing increased controls was considered during the drafting process. The

NRC and Agreement States considered effectiveness, the potential burden on licensees, and

costs required of licensees to comply with the increased controls. The increased controls allow

for substantial flexibility in meeting the objectives so that licensees can tailor measures to their

own specific programs and operations. With appropriate enhancements, existing security,

safety, and business practices can adequately address the requirements of the increased

controls. Also, the bases for the increased controls are very similar to the requirements of other

agencies (e.g., select agent, hazardous material, or explosive material security requirements),

which many licensees are already implementing.

189. Is there financial aid or funding available to assist in the implementation of the

increased controls? Will the licensees be compensated in any way? Perhaps

forgoing fees for a year?
-44-

The NRC and Agreement States can not compensate licensees or forgo fees to alleviate

potential costs. However, there will be no fees for the initial compliance inspections related to

the increased controls. There are no specific funds or financial resources available, at this

time, to defray the costs to licensees for enhancing security of these radioactive materials. 

This is considered a new cost for doing business that many other industries with hazardous

materials are facing. The objectives of the increased controls can be met through procedural

changes to existing safety and security programs and through the use of detection, alarm, and

communications technologies that are widely available on the commercial market.

190. Were the increased controls derived from a vulnerability or design basis threat

analysis?

There is no design basis threat analysis. However security/vulnerability assessments were

used to inform the selection of the increased controls. The NRC and Agreement States are

concerned with those activities that could lead to any malevolent use of radioactive material. 

Accordingly, the increased controls have been designed to mitigate both the potential for theft

and sabotage-in-place of radioactive material as well as potential detrimental consequences to

public health and safety.

191. What steps is the Commission taking to educate the public, in terms of its

response to an event?

The NRC and the Agreement States are working with DHS and other government and private

organizations to assist in educating the public in this regard. DHS has programs to assist in

training for first responders. 

192. One commenter recommended that more prescriptive security measures be

developed, such as requirements for a written security program and performance

of facility specific risk assessments.

The increased controls are purposely not prescriptive in order to allow licensees to tailor

programs to their specific facility and operations. Various approaches are available to licensees

to meet the objectives of the increased controls, and that there exists no one solution for all

licensees.

193. Some licensees would only possess quantities that meet or exceed the

thresholds for very short periods such as during source change outs. Will these

licensees be required to implement the increased controls?

Licensees that possess quantities that meet or exceed the thresholds will have to implement

the increased controls for those periods they possess those quantities. However, there will

provide an opportunity for licensees to request exceptions to some or all of the increased

controls and the staff will consider those requests. If adequate justification is provided by the

licensee, exceptions may be granted.

194. Should “high-risk radioactive material” be replaced with “quantities of concern of

radioactive material”?

The term “high-risk radioactive material” will no longer be used throughout the increased
-45-

controls, and Implementing Guidance. The term "high-risk" used to define the subset of

radioactive material covered by the increased controls is deleted. It is not used internationally

or found in the IAEA Code of Conduct or its Guidance, which refer to sources "...that may pose

a significant risk to individual, society and the environment, if handled improperly." The

increased control defines this subset of material as that listed in Table 1.

195. Does the database include all old radiography cameras (and sources) prior to

1996 when new cameras were required to be purchased by licensees? (i.e.

cobalt-60 cameras) 

The interim database contains information about sources containing radioactive material that

exceed the quantities listed in Table 1, Radionuclides of Concern. The database does not

contain information about devices or old cameras. 

196. Why is NRC regulating Ra-226 listed in Table 1?

Ra-226 was originally included in Table 1 for informational purposes and for consistency with

the IAEA Code of Conduct. Table 1 has since been changed to align with NRC’s authority. 

The Atomic Energy Act of 1954, as amended, does not authorize NRC to regulate naturally

occurring radioactive material like Ra-226. However, Agreement States, have the authority and

may choose to apply the increased controls to Ra-226. 

197. If a terrorist does blow up a source, how does the licensee know how large an

area to evacuate? Has the NRC or one of the National Laboratories taken sources

and tested them to see what level of explosives it would take to disperse the

radioactive material?

National Laboratories have done explosives tests to better determine the dispersibility and

consequences of various radioactive sources of concern for use in a Radiological Dispersal

Device (RDD). The extent of local contamination would depend on a number of factors,

including the size of the explosive, the amount and type of radioactive material used, the means

of dispersal, and weather conditions. Those closest to the RDD would be the most likely to

sustain injuries due to the explosion. As radioactive material spreads, it becomes less

concentrated and less harmful. Prompt detection of the type of radioactive material used will

greatly assist local authorities in advising the community on protective actions, such as

sheltering in place, or quickly leaving the immediate area. While the explosive blast will be

immediately obvious the initial evacuation would be based on the size of the explosion. The

presence of radiation will not be known until trained first responders with specialized equipment

are on the scene and can determine the radiation dose rates for recommended protective

actions based on the Environmental Protection Agency’s Protective Action Guidelines. 

Licensees can best advise the LLEA on safe distances for radiation protection if a source is

used as an exposure device.

198. Was any media invited to attend or allowed to attend any of the Stakeholder 

meetings on the draft Measures?

No. Attendance at all the Stakeholder meetings to discuss increased controls was by invitation

and confirmed reservation only.
-46-

199. If a facility has multiple sources that when added together would exceed the

quantity of concern, but they are spread out over a large facility (i.e., cesium flow

meters on process piping), would they still be covered under the aggregate

activity even though they are not collocated?

Footnote 3 on Table 1 indicates: "Radioactive materials are to be considered aggregated or

collocated if breaching a common physical security barrier (e.g., a locked door at the entrance

to a storage room) would allow access to the radioactive material or devices containing the

radioactive material." There is a process by which a licensee may request relief from the

Increased Control if compliance with any of the requirements is unnecessary in specific

circumstances. The process is communicated in the language of the Increased Control.

200. Could certain licensees be categorically excluded or exempted from some or all

of the increased controls based on inherently low specific activity?

NRC and Agreement States agree that low specific activity radioactive material inventories pose

a lower risk. Increased controls are being issued to certain types of licensee’s based on their

authorized possession limits. Specific activity thresholds were not established for categorical

exclusion. Rather, implementation of the increased controls is based on possession of

quantities of radioactive material that are greater than or equal to Table 1. There is a process

by which a licensee may request relief from the increased controls if compliance with any of the

requirements is unnecessary in specific circumstances.

201. Are the increased controls proportional to the uses of the radioactive materials

and do they allow licensees to take into account the circumstances, location and

security measures that may already be in place for other things?

Yes, the NRC and Agreement States have developed various Compensatory Measures,

Additional Security Measures and Increased Controls for different types of licensees that are in

proportion to today’s regulatory environment and potential consequences of malevolent acts. 

The NRC and Agreement States recognize that various approaches are available to licensees

to meet the objectives of the increased controls, and that there exists no one solution to any

safety or security challenge facing licensees. If programs exist for other activities at a

licensees site, that accomplish the same objectives as the increased controls, licensees do not

have to create a separate program for their radioactive material.