Vi.

Vil.

Vii.

POINTS OF CONTACT

A.

The principal senior management contacts for this MOU will be DOE's
Assistant Manager for Nuclear Fuel Supply, Oak Ridge Office, and NRC’s
Director, Division of Fuel Cycle Safety and Safeguards, Office of Nuclear
Material Safety and Safeguards. These individuals may designate
appropriate staff representatives for the purpose of administering this
MOU.

Identification of these contacts is not intended to restrict communication
between DOE and NRC staff members on technical and other day-to-day
activities.

EFFECTIVE DATE, MODIFICATION, TERMINATION

A.

This MOU shall become effective upon the signing of this document by
both parties. This MOU shall remain in effect for five years from the date
of signing by both parties unless terminated beforehand in accordance
with the procedures set forth in this MOU.

This MOU may be modified or amended by mutual agreement of NRC
and DOE. All modifications or amendments of this MOU must be in
writing and signed by the authorized representative of NRC and DOE.

. Either party may terminate this MOU by providing the other party with

written notification of its intent to terminate. Such written notification must
be provided at least 180 days prior to the effective date of the termination
of this MOU.

. This MOU may be renewed or extended by the written mutual agreement

of NRC and DOE.

SEPARABILITY

If any provision of this MOU, or the application of any provision to any person
or circumstance, is held to be invalid, the remainder of this MOU and the
application of the remaining provisions to other persons or circumstances
shall not be affected.


B. DOE

1. DOE shall serve, pursuant to a formal designation from NRC ina
subsequent IA, as the DAA for classified IT systems at specified
uranium enrichment facilities licensed or otherwise regulated by NRC.
As DAA, DOE shall inspect these classified IT systems to determine
that they are installed and capable of operating in accordance with all
applicable security requirements and provide the written results of
these inspections and an accreditation statement to NRC.

In the event DOE has provided an accreditation statement to NRC
and, upon subsequent review or inspection, determines that the
accredited system is not capable of operating in accordance with
applicable security requirements, DOE shall make a determination
regarding continuing or revoking the accreditation and shall promptly
notify NRC. Upon such notification from DOE, NRC shall take prompt
and appropriate action to enforce DOE's determination on
accreditation.

2. DOE shall provide, pursuant to the subsequent IAs, technical
assistance to NRC in its review, evaluation, and inspection of
classified IT systems and OPSEC, TSCM, and TEMPEST programs
implemented at specified uranium enrichment facilities licensed or
otherwise regulated by NRC.

3. DOE shall prepare a draft and final work plan describing the classified
matter protection program evaluations and inspections that it plans to
perform in carrying out its responsibilities under this MOU. This work
plan shall set forth the standards to be used in conducting the
evaluations and inspections.

4. DOE shall prepare and submit a final report to NRC summarizing the
evaluations and inspections performed by DOE over the previous
year. This report shall identify any compliance issues encountered at

each facility inspected.

Vv. RESOLUTION OF DISPUTES

A. NRC and DOE shall work together to amicably resolve any disputes or
disagreements that might arise over matters within the scope of this
MOU. Resolution of differences between NRC staff and DOE staff will be
the initial responsibility respectively of the chief of the responsible branch
within NRC and the DOE Regulatory Oversight Manager in the DOE Oak
Ridge Office.

B. If the issue cannot be resolved at the staff level, NRC and DOE agree to
refer the matter within thirty (30) days to the Director, Division of Fuel
Cycle Safety and Safeguards, Office of Nuclear Material Safety and
Safeguards, NRC, and the Assistant Manager for Nuclear Fuel Supply,
Oak Ridge Office, DOE.


For the U.S. Nuclear Regulatory Commission

pA GC fee
Robert C. Pierson
Director, Division of Fuel Cycle Safety
and Safeguards
Office of Nuclear Material Safety
and Safeguards
U.S. Nuclear Regulatory Commission

For the U.S. Department of Energy

Vari . Clark

Assistant Manager for Nuclear
Fuel Supply

Oak Ridge Office

U.S. Department of Energy


August 13, 2007

MEMORANDUM OF UNDERSTANDING
BETWEEN THE
UNITED STATES NUCLEAR REGULATORY COMMISSION
AND THE
UNITED STATES DEPARTMENT OF ENERGY

PROTECTION OF CLASSIFIED INFORMATION
AND RELATED SECURITY ACTIVITIES AT
URANIUM ENRICHMENT FACILITIES

BACKGROUND

The U.S. Nuclear Regulatory Commission (NRC) is responsible for licensing
and regulating all commercial uranium enrichment facilities operating in the

United States.

Based on existing experience and anticipated activity, an entity that owns or
operates a uranium enrichment facility under NRC license and regulation wilt
need to process classified information at its uranium enrichment facility. The
National Industrial Security Program (NISP), established by Executive Order
(E.O.) 128289 for the protection of classified information classified under E.O.
12958, as amended, or its successor or predecessor orders, and the Atomic
Energy Act of 1954, as amended, requires that classified information can only
be processed on secure information technology (IT) systems or networks that
have been accredited by certain agencies of the Federal government,
including NRC and the U.S. Department of Energy (DOE). The NISP is set
forth in Department of Defense (DoD) 5220.22-M, and requires. that a Federal
government agency agree to act as the Designated Approval Authority (DAA)
for a specific classified IT system. The DAA inspects the classified IT system
to determine that it is installed and capable of operating in accordance with all
applicable security requirements and then issues an accreditation statement
prior to system operation. Accordingly, these entities will need a Federal
government agency to act as the DAA for their classified IT systems.

NRC is responsible for the licensing and regulation of commercial uranium
enrichment facilities operating in the United States. As such, NRC is
responsible for enforcing any violations of the licenses issued to these
facilities, including any security violations. Therefore, in order to avoid the
appearance of a conflict of interest, NRC requested that DOE act as the DAA
for these uranium enrichment facilities.

NRC, mindful of DOE's unique expertise in protecting classified matter within
its own nuclear programs, determined that DOE would be the most qualified
Federal entity to serve as DAA for commercial uranium enrichment facilities.

Upon request and a formal designation from NRC, DOE agrees to serve as
the DAA for specified uranium enrichment facilities and provide technical
assistance on related security matters pursuant to an interagency agreement
(IA) with NRC for the specified uranium enrichment facility, NRC anticipates
@ current and future need for assistance from DOE as the DAA for


commercial uranium enrichment facilities. The facilities for which NRC
requires such DOE assistance will be specified in an IA between NRC and
DOE, and NRC will formally designate DOE as the DAA for the specified
uranium enrichment facility through the IA.

NRC intends to issue orders to uranium enrichment facilities that possess
classified matter to implement additional security measures for IT systems,
an operational security program (OPSEC), a technical surveillance
countermeasures program (TSCM), and a Telecommunications Electronic
Materials Protected from Emanating Spurious Transmissions (TEMPEST)
Program. NRC requires technical assistance from DOE subject matter
experts for providing oversight of these areas.

AUTHORITY

NRC enters into this Memorandum of Understanding (MOU) under the
authority of Section 205(c) of the Energy Reorganization Act of 1974, 42
U.S.C. § 5845(c). DOE enters into this MOU under the authority of Section
646 of the Department of Energy Organization Act (Pub. L. 95-91, as
amended; 42 U.S.C. § 7256).

PURPOSE AND SCOPE

A. NRC and DOE enter into this MOU to define and set forth their mutual
understanding of the assistance that DOE will provide NRC in carrying
out its responsibilities with respect to certain classified IT systems and
related security activities at specified uranium enrichment facilities
licensed or otherwise regulated by NRC.

B. DOE agrees to provide NRC with assistance in carrying out NRC’s
responsibilities with respect to certain classified [T systems and related
security activities at specified contractors, subcontractors, and vendors of
these uranium enrichment facilities licensed or otherwise regulated by

NRC.

C. This MOU is neither a fiscal nor a funds obligating document. Nothing in
this MOU authorizes or is intended to obligate the parties to expend,
exchange, transfer, or reimburse any funds, services, or supplies, or to
enter into any contract, assistance agreement, interagency agreement, or
any other financial obligation.

D. Nothing in this MOU shall restrict or otherwise limit the authority of either
NRC or DOE to exercise its full regulatory authority, including both
inspection and enforcement authority within each agency's jurisdiction.

E. This MOU is strictly for the internal management purposes of each of the
parties. Itis not a legally enforceable document and shall not be
construed to create any legal obligation on the part of either party or to
provide a private right or cause of action for or by any person or entity.


F. This MOU in no way restricts either of the parties from participating in any
activity with other public or private agencies, organizations, or individuals.

G. This MOU applies solely to the activities described in this agreement
related to uranium enrichment facilities, except those facilities identified
below in subsection H. Nothing in this MOU applies to or establishes a
precedent for any other MOU, matter, or agreement, including any other
existing or future agreement between DOE and NRC.

H. On October 28, 1997, NRC and DOE executed the “Memorandum of
Understanding between the Nuclear Regulatory Commission and the
Department of Energy on Cooperation Regarding the Gaseous Diffusion
Plants.” On March 24, 2004, NRC and DOE executed the “Memorandum
of Understanding between the Department of Energy and the Nuclear
Regulatory Commission — Cooperation Regarding the Gas Centrifuge
Lead Cascade Facilities at the Portsmouth Gaseous Diffusion Plant Site.”
On April 13, 2007 NRC and DOE executed the “Memorandum of
Understanding between the Department of Energy and the Nuclear
Regulatory Commission — Cooperation Regarding the American
Centrifuge Plant in Piketon, Ohio.” Nothing in this MOU is intended to
restrict, expand or otherwise alter the terms of the October 28, 1997, the
March 24, 2004, or the April 13, 2007, MOUs.

|. All agreements herein are subject to, and will be carried out in compliance
with, all applicable laws, regulations, and other jegal requirements.

W. ROLES AND RESPONSIBILITIES

A. NRC

1. NRC shall serve as the Cognizant Security Authority (CSA) for
specified uranium enrichment facilities licensed or otherwise regulated
by NRC that require a facility clearance for access to classified
information. As the CSA, NRC shall be responsible for issuing any
required individual security clearances and facility clearances.

2. NRC shall review and approve a security plan for specified uranium
enrichment facilities licensed or otherwise regulated by NRC. This
security plan shall set forth specific requirements for implementation
of a classified matter protection program, to include !T security, at
specified uranium enrichment facilities licensed or otherwise regulated

by NRC.

3. The NRC-approved security plan shall include specific requirements
for IT systems, an OPSEC program, a TSCM program, and a
TEMPEST program to be implemented at specified uranium
enrichment facilities licensed or otherwise regulated by NRC.