SAFEGUARDS INFORMATION

Enclosure 2 Contains Safeguards

Information. When Separated from

Enclosure 2, this cover document is

DECONTROLLED.

SAFEGUARDS INFORMATION

June 30, 2006

The Honorable James M. Inhofe

Chairman, Committee on Environment 

 and Public Works

United States Senate

Washington, D.C. 20510

Dear Mr. Chairman:

The Energy Policy Act of 2005, H.R. 6, Section 651(a), directed the U.S. Nuclear

Regulatory Commission (NRC) to submit an annual report in classified and unclassified to the

Committee on Environmental and Public Works of the Senate and the Committee on Energy

and Commerce of the House of Representatives that describes the results of each security

response evaluation (i.e., force-on-force evaluations) conducted and any relevant corrective

action taken by a licensee. On behalf of the Commission, I am pleased to transmit the first

such annual report for calender year 2005. I am also providing additional information regarding

the overall security and safeguards performance of the commercial nuclear power industry to

keep you informed of NRC's efforts to protect the Nation's electric power infrastructure against

terrorist attacks.

The NRC is committed to protecting public health and safety, promoting the common

defense and security, and protecting the environment. Conducting force-on-force exercises

and implementing our security inspection program are two of a number of regulatory oversight

activities the NRC staff performs to ensure the safe and secure use and management of

radioactive materials by the commercial nuclear power industry. 
SAFEGUARDS INFORMATION

SAFEGUARDS INFORMATION

- 2 -

I am confident that nuclear power plants continue to be among the best protected

private sector facilities in the Nation. The NRC is committed to ensuring strong security at

these facilities. Please do not hesitate to call me if I may provide additional information.

Sincerely,

 /RA/

Nils J. Diaz

Enclosures: 

1. CY 2005 Annual Status Report on the Results of 

 the Security Inspection Program (Non-sensitive Version)

2. CY 2005 Annual Status Report on the Results of 

 the Security Inspection Program (Safeguards Information)

cc: Senator James Jeffords
SAFEGUARDS INFORMATION

Identical letter sent to:

The Honorable James M. Inhofe

Chairman, Committee on Environment 

 and Public Works

United States Senate

Washington, D.C. 20510

cc: Senator James Jeffords

The Honorable Joe Barton 

Chairman, Committee on Energy and Commerce

United States House of Representatives

Washington, D.C. 20515

cc: Representative John D. Dingell

SAFEGUARDS INFORMATION
Enclosure 1

ANNUAL STATUS REPORT ON THE RESULTS OF THE

SECURITY INSPECTION PROGRAM CONDUCTED BY THE

UNITED STATES 

NUCLEAR REGULATORY COMMISSION

CALENDAR YEAR 2005
TABLE OF CONTENTS

I Executive Summary .......... .......... .......... .......... .......... . . 2

II Background .......... .......... .......... .......... .......... ........ 3

Prior to September 11, 2001 .......... .......... .......... ......... 3

Response to September 11, 2001 .......... .......... .......... ..... 3

III Baseline Inspection Program .......... .......... .......... .......... ..... 4

IV Significance Determination Process .......... .......... .......... ......... 7

V CY 2005 Baseline Security Inspection Results .......... .......... .......... . 8

VI FOF Inspection .......... .......... .......... .......... .......... ..... 8

Evolution of FOF Inspections .......... .......... .......... ......... 8

Qualification of FOF Inspectors .......... .......... .......... ...... 10

Exercise Simulation Systems .......... .......... .......... ........ 10

Composite Adversary Force .......... .......... .......... ......... 11

Inspection Procedure 71130.03 Revision .......... .......... ......... 12

Improved Controller Training and Qualification .......... .......... .... 12

Beyond the DBT and Technical Approaches to Beyond DBT .......... .... 12

Indeterminate Exercise .......... .......... .......... .......... . . 13

VII FOF Regulatory Program Activities .......... .......... .......... ......... 13

VIII FOF 2006 Planned Activities .......... .......... .......... .......... .... 14

IX Disposition of Findings .......... .......... .......... .......... ........ 14

X Communications .......... .......... .......... .......... .......... ... 15

XI Interagency Support .......... .......... .......... .......... .......... 15

XII Reference List .......... .......... .......... .......... .......... ..... 16

XIII Acronym List .......... .......... .......... .......... .......... ...... 17
Page 2 of 17

I Executive Summary

The Energy Policy Act of 2005, H.R. 6, Section 651(e), directed the U.S. Nuclear Regulatory

Commission (NRC) to submit an annual report in classified and unclassified form to the

Committee on Environmental and Public Works of the Senate and the Committee on Energy

and Commerce of the House of Representatives, that describes the results of each of the

security response evaluations (i.e., force-on-force exercises) conducted by NRC and any

relevant corrective action taken by a licensee. This is the first annual report covering calender

year (CY) 2005. The NRC is also providing additional information regarding the overall security

performance of the commercial nuclear power industry to keep the Congress and the public

informed of the NRC's efforts to help protect the Nation's electric power infrastructure against

terrorist attacks. 

The NRC is committed to protecting public health and safety, promoting the common defense

and security, and protecting the environment. Conducting our security inspection program,

which includes force-on-force (FOF) exercises, is one of a number of regulatory oversight

activities the NRC performs to ensure the secure use and management of radioactive materials

by the commercial nuclear power industry. In support of these activities, the NRC employs

relevant intelligence information and vulnerability analyses to determine realistic and practical

security requirements and mitigative strategies. Further, a risk-informed, graded approach is

used to establish appropriate regulatory controls, enhance NRC inspection efforts, assess the

significance of issues, and to influence timely and effective corrective action by licensees of

commercial nuclear power plants for identified deficiencies. These practices utilize interagency

cooperation in the development of an integrated approach to the security of nuclear facilities

and contribute to NRC's comprehensive evaluation of licensee security performance.

During CY 2005, the NRC-conducted security inspections, including FOF exercises at NRClicensed commercial nuclear power plants (NPP) based on risk insights, security assessments,

and logistical considerations. FOF exercises at NRC-licensed Category I (CAT I) fuel cycle

facilities were commenced in early CY 2006 and will be described in subsequent annual

reports.

This report describes the evolution of the NRC’s security inspection program, including the

security baseline inspection program for CY 2005 and details for the FOF program from 

pre-September 11, 2001, to the present highlighting enhancements to the program. The

reporting period included herein is October 29, 2004, through December 31, 2005.

During the reporting period, the NRC conducted 134 inspections (of which 23 were FOF

exercises). These inspections identified 107 findings of which 99 findings were of very low

security significance and 5 findings were of low to moderate security significance.
1

 “Protecting Our Nation” (See referenced list in Section XII.)

Page 3 of 17

II Background

Prior to September 11

Before the terrorist attacks on September 11, 2001, the NRC conducted security inspections at

all NPP facilities to ensure compliance with NRC regulations. These included FOF exercises at

each commercial NPP approximately once every 8 years. According to NRC regulations, NPP

licensees conducted their own FOF exercises on an annual basis, which the NRC observed. 

However, in the wake of the terrorist attacks, the Commission temporarily suspended the FOF

exercises at NPP facilities. The Commission’s primary concern was that conducting such

exercises could have distracted the licensees’ security forces and the NRC staff during a time

when licensees needed to focus on implementing the NRC’s highest level of alert, as well as

numerous security upgrades.1 Although FOF inspections were temporarily suspended, NRC

continued to conduct the baseline security inspection program including its practice to

periodically inspect licensees through the use of NRC security specialist inspectors and on-site

resident inspectors who maintain daily vigilance over matters of nuclear safety, security, and

emergency preparedness, as well as other regulatory activities.

Response to September 11 - Summary of Security Enhancements

In response to the September 11, 2001 terrorist attacks, the NRC immediately advised nuclear

power plants to go to the highest level of security in accordance with the system in place at the

time. In the weeks and months following September 11, 2001, the NRC focused its efforts on

enhancing security at the facilities it regulates. The terrorist attacks reaffirmed the need for

collective vigilance, enhanced security and safeguards, and improved emergency preparedness

and incident response capabilities throughout the Nation's electrical infrastructure. As a result,

the NRC conducted a thorough review of the agency's security and safeguards programs and

made enhancements, in part to strengthen its requirements for NRC-licensees and to improve

coordination to defend against a more challenging adversarial threat. 

On February 25, 2002, the NRC issued Orders to NPP licensees requiring that they increase

their defensive capabilities in the post-9/11 threat environment. These enhancements to

security included increased security patrols, augmented security forces, additional security

posts, increased standoff distances for vehicles, improved coordination with law enforcement

and intelligence communities, and strengthened safety-related mitigation procedures and

strategies. 

On January 7, 2003, the NRC issued another Order requiring further enhancements to access

controls for the NPPs. On April 29, 2003, the NRC issued three additional Orders requiring

security enhancements in the areas of: 1) a supplemented design basis threat (DBT) for

radiological sabotage, 2) enhanced training on tactical and firearms proficiency and physical

fitness, and, 3) fitness-for-duty, including security force personnel work-hour limitations. These

Orders required all licensees to continue to meet all previous security requirements. 

The DBT is a set of adversary characteristics established by the Commission as the basis for

the design of the licensee’s security systems. In establishing the DBT, the Commission

considers intelligence information, protective measures that may be employed (including 
2

 Letter from Chairman Diaz to Department of Homeland Security, Secretary Tom Ridge, dated September 8, 2004.

Page 4 of 17

potential unintended consequences), and availability of such measures to private security

forces, to determine the adversary characteristics that are reasonable to expect a private force

to protect against.

The April 2003 Orders required all NPP licensees to submit revised security plans to the NRC

for review and approval by April 29, 2004, and that the plans be implemented by 

October 29, 2004. All licensees met this requirement.2 These measures and others are

periodically evaluated by the NRC through its baseline security inspection program, which

includes the conduct of FOF inspections. For other NRC licensees, NRC issued similar orders

enhancing security-related requirements and measures to protect the public health and safety,

to promote the common defense and security, and to protect the environment.

III Baseline Inspection Program

The NRC continues to implement the Reactor Oversight Process (ROP) which is the agency's

program for ensuring plant and radiological safety, security, and emergency preparedness at all

operating nuclear power plants. The basic principles and philosophy of the ROP are to ensure

that a defined, repeatable, and objective process is applied to identify findings, determine their

significance, and document results in accordance with ROP program guidance. Program

instructions and inspection procedures help provide assurance that licensee actions and

regulatory response are commensurate with the safety or security significance of the particular

event, deficiency, or weakness. Within each ROP cornerstone (see Figure 1), NRC

headquarters and regional specialist inspectors conduct inspections using detailed inspection

procedures whose results, in the aggregate, contribute to an overall assessment of licensee

performance. 
Page 5 of 17

The NRC significantly enhanced its baseline security inspection program for commercial

nuclear power plants since September 11, 2001. This inspection effort resides within the

"Security Cornerstone" of the agency's ROP. The Security Cornerstone focuses on five key

licensee performance attributes: access authorization; access control; physical protection;

material control and accounting (MC&A); and response to contingency events. Through the

results obtained from all oversight activities, including but not limited to baseline security

inspections, the NRC determines whether licensees comply with requirements and can provide

high assurance of adequate protection against the DBT for radiological sabotage.

NRC oversight of licensee security capability has increased significantly since the terrorist

attacks of September 11, 2001. In 2000, approximately 40 staff-weeks of direct inspection

effort were spent on security inspections (excluding FOF exercises) for nuclear power reactors. 

By 2003, this inspection effort had increased to 205 staff weeks. This effort focused on

licensee implementation of compensatory measures to address the post-9/11 threat

environment. These compensatory measures were required by the Commission's February 25,

2002, Order. In late 2003, the staff developed the revised baseline inspection program for

reactor security, taking into consideration the enhanced requirements and elevated threat

environment. The staff began implementation of the revised baseline inspection program in

March 2004. These inspections focused on those elements of the program that had been fully

implemented under the previous Orders, such as access authorization and security force work

hour limits. The NRC also implemented a Management Review Panel to ensure that inspection

findings and potential violations are treated in a consistent and appropriate manner. During CY

2005, the inspection effort focused on verifying licensee implementation of the remaining

Commission’s Orders. The staff expended approximately 400 staff-weeks of direct inspection

effort in 2005. Implementation of all elements of the baseline security inspection program

commenced in January 2006.

In a related matter, following the terrorist acts of September 11, 2001, the NRC determined that

there was a potential that security-related information routinely made public through the NRC

web-site and the NRC’s public reading rooms could aid potential adversaries seeking to cause

radiological sabotage or theft or diversion of radioactive materials. Therefore, the NRC revised

its information dissemination policy to ensure that security-related information is not provided to

a possible adversary. This policy specifically applied to information related to licensee security

and safeguards performance, including generic or nation-wide performance information. As a

result, the public is provided limited information on regulatory decisions or actions involving

security inspection, assessment, or enforcement. In keeping with the NRC strategic goal of

openness in our regulatory process, the Commission reassessed this policy on May 1, 2006,

and is making certain results of its security inspection program for commercial NPPs available 

to the public.

As discussed, the security inspection program for commercial NPPs resides within the Security

Cornerstone. The cornerstone has four objectives: (1) to obtain information providing objective

evidence that the security and safeguards at NRC-licensed NPPs are maintained in a manner

that contributes to public health and safety and promotes the common defense and security;

(2) to determine that licensees have established measures to deter, detect, and protect against

the DBT for radiological sabotage as required by regulations and other Commission mandates

such as Orders; (3) to determine the causes of declining performance in the physical protection

arena before such performance reaches a level that may result in a degradation to reactor
Page 6 of 17

safety or undue risk to public health and safety; and (4) to identify those significant issues that

may have generic or cross-cutting applicability. These objectives help ensure the secure use

and management of radioactive materials.

The baseline inspection program requires 12 "inspectable areas" to be reviewed periodically at

each power reactor facility (see Figure 2). In addition, MC&A inspections are conducted to

ensure that licensees take adequate measures to control the risk of loss, theft, or diversion of

special nuclear material.

Where performance issues have been identified at a particular licensee, supplemental

inspections may be conducted to further investigate a particular deficiency or weakness. In

certain situations, the NRC Regional Administrator may authorize the conduct of a generic,

special, or infrequent inspection. Such an inspection is not part of the baseline or supplemental

inspection program and would only be conducted after a review and assessment of a particular

security or safeguards event or condition. These types of inspections include, but are not

limited to: resolution of employee concerns, security matters requiring particular focus, licensee

plans for coping with strikes, and inspection of international safeguards. During the reporting

period, a special inspection was conducted at a NPP to review performance issues with the

intrusion detection system. 
Page 7 of 17

The NRC is currently evaluating the efficacy of the Physical Security Performance Indicators

(PIs) to determine if revisions are warranted to enhance their function as leading indicators, or if

a different program would serve the need more efficiently. The PIs are a means of obtaining

information related to the performance of certain key attributes in each of the cornerstone

areas.

Regulatory response to identified security-related deficiencies is in accordance with an action

matrix based on the security significance of the inspection finding. Both the significance of the

finding and the actions required are implemented through NRC procedures that ensure such

assessments are predictable, repeatable, and commensurate with the event, deficiency, or

performance weakness.

IV Significance Determination Process (SDP)

The SDP uses risk insights, where appropriate, to help NRC inspectors and staff determine the

security significance of inspection findings. Security-related findings are evaluated using the

baseline Physical Protection Significance Determination Process (PPSDP). These findings

include both programmatic and process deficiencies. The PPSDP provides the security

significance of any security program deficiency. Unresolved items (URI) are discussed within

the inspection team, and documented in the inspection report. A URI is an issue about which

more information is required to determine if it is acceptable, if it is a finding, or if it constitutes a

deviation or violation. Such a matter may require additional information from the licensee or

may require additional guidance or clarification/interpretation of the existing guidance.

In July 2004, the staff issued and began piloting a separate Significance Determination Process

(SDP) for FOF inspections. The staff completed the FOF SDP pilot in December 2004. In

addition to the pilot SDP, the staff applied NRC Inspection Manual Chapter 0609, “Significance

Determination” guidance to ensure an objective and common framework was utilized. As

lessons learned are compiled throughout the inspection process, the SDP may be reevaluated

and revised. 

The significance of findings associated with FOF adversary actions are dependent on how far

into the plant the mock adversaries force progresses, their impact on critical equipment

(referred to as a target set), and a determination of whether or not these actions had an

adverse impact on the public.

Force-on-force findings are evaluated using the FOF SDP. Other security-related findings

identified during FOF activities are also evaluated using the baseline PPSDP. These findings

may include programmatic and process deficiencies that are not directly related to a FOF

inspection outcome, but are identified during the FOF exercise. All URIs are discussed within

the inspection team, and documented in the inspection report. In situations where the NRC

cannot clearly determine the outcome of an exercise, the exercise may be considered

indeterminate and any identified process or programmatic deficiencies would be processed

through the baseline PPSDP.
Page 8 of 17

V CY 2005 Baseline Security Inspection Program Results

Table 1 summarizes the overall results of the security inspection program excluding FOF

inspection results. This information provides a summary overview of licensee performance

within the Security Cornerstone. 

Violations and non-cited violations (NCV) are categorized by significance, and are given

corresponding color or severity level (SL) codes, as follows: green or SL IV (very low security

significance); white or SL III (low to moderate security significance); yellow or SL II (substantial

security significance); and red or SL I (high security significance). White, yellow and red

findings are considered greater than green. Any finding that is greater than green proceeds in

the normal enforcement process. 

Table 1, CY 2005 Baseline Security Inspection Program Results without FOF Inspections

CY 2005 Baseline Security Inspection Program Results

111 Total number of inspections conducted across the industry.

104 Total number of inspection findings across the industry.

85 Total number of Green findings.

3 Total number of greater than Green findings.

14 Total number of SL IV violations.

2 Total number of greater than SL IV violations.

6 Total number of special inspections conducted.

0 Total number of licensees within the Degraded Security Cornerstone.

0 Total number of licensees within the Repetitive Degraded Cornerstone.

0 Total number of licensees with Unacceptable Performance.

VI FOF Inspection

Evolution of FOF Inspections

The NRC phased in the enhanced FOF program over a 2-year period in conjunction with testing

56 percent of the commercial NPPs in the country. The first phase consisted of an expanded

table-top program conducted in 2002 at seven NPP sites. The second phase, an expanded

pilot FOF exercise program, began in February 2003 and was conducted at 15 NPPs. The

second phase incorporated lessons learned from the expanded table-top program. 

This pilot FOF program assessed the post-9/11 program changes that included additional

participants; enhanced weaponry; more complex tactical approaches and protective strategies;

increased attention to adversary approach, capture, and destroy tactics; and state-of-the-art

exercise equipment. Additionally, one site conducted training exercises beyond the DBT with
3

 See “Protecting Our Nation,” and Office of Public Affairs “Backgrounder” on Force-on-Force.

Page 9 of 17

incrementally larger numbers of adversaries and enhanced weaponry. The licensees that

participated in the FOF pilot program were pre-selected to represent a reasonable sampling of

the various designs, locations, number of responders and size of facility.

In February 2004, the NRC began the final phase, starting with a transitional force-on-force

(TFOF) program, that incorporated lessons learned from the previous 2 years. The TFOF

mock adversary force used the characteristics of the DBT, as enhanced and supplemented by

NRC Orders, that had expanded adversary force capabilities. A total of 13 sites had

participated in the TFOF program by October 2004.

In November 2004, NRC began implementation of its redesigned, full-scale FOF inspection

program that incorporates experience and lessons learned since September 11, 2001. The

NRC has increased the frequency of FOF inspections so that each nuclear power plant site

participates in one NRC-conducted FOF inspection (which typically includes three NRCevaluated exercises) at least once every 3 years, rather than once every 8 years. In addition,

each plant is required to conduct its own independent exercise (tactical response security

exercises) at least once a year. The conduct of these licensee tactical response security

exercises are subject to NRC oversight. The current FOF program reflects the supplemented

DBT for radiological sabotage and significantly increases the level of realism, while ensuring

NRC licensees are meeting regulatory requirements. Lastly, during 2004, the NRC enhanced

its oversight of licensee security equipment performance testing and maintenance; protective

strategy and severe accident management; fitness for duty; information and technology

security; and physical protection of shipments of nuclear material. 

In conducting FOF inspections, NRC notifies the licensee in advance for safety and logistical

purposes. This notification provides adequate planning time for licensee coordination of two

sets of security officers - one for maintaining actual plant security and the other for participating

in the exercise. In addition, arrangements must be made by the licensee for a group of

individuals who will control and monitor each exercise. A key goal of the NRC is to balance

safety (both personnel and operational), while maintaining actual plant security during an

exercise that is as realistic as possible.

In preparation for a FOF inspection, information from table-top drills, other baseline security

inspections, and security plan reviews are used to design a number of commando-style attack

scenarios seeking to probe for potential deficiencies in the licensee’s protective strategy. The

aim of the site’s defenders is to keep the attackers from destroying or damaging (simulated in

an FOF exercise) critical equipment (target sets). Any potential deficiencies in the protective

strategy identified during FOF exercises are promptly reviewed and corrected before NRC

inspectors leave the licensee’s site.3

The NRC recently clarified that the FOF program does not focus solely on success or failure in

protecting critical equipment (target sets), but also identifies licensee performance weaknesses

and areas for improvement. This allows the NRC to more reliably assess the capability of a

licensee security force to execute an effective protective strategy. The FOF program retains

the goal of protecting critical equipment (target sets) and applies the performance assessment
4

 “Protecting Our Nation.”

Page 10 of 17

tools and techniques. This philosophy comports with the principles of the NRC ROP and is

more effective in both assessing and improving licensee performance. 

Qualification of FOF Inspectors

In order to meet the needs of an accelerated inspection schedule, the NRC had to increase

staffing levels. The NRC recruited and hired security specialists with substantial experience

from outside the agency, including industry, law enforcement, and the military. Throughout

2004, the FOF inspection team members completed various training courses, self-study

programs, and NPP site visits. Each inspector was required to sit before an oral qualification

board to demonstrate his or her knowledge of the regulatory and inspection processes, required

as part of the NRC’s inspector qualification program. Team members were certified as interim

inspectors prior to November 2004, awaiting attendance of additional training courses and onthe-job training. Inspectors continue to enhance knowledge of the latest trends and advances

in security and increase their understanding of reactor systems. 

Exercise Simulation Systems (ESS)

As one of the ongoing enhancements to improve the realism of FOF exercises, the NRC

incorporated Multiple Integrated Laser Engagement System (MILES) equipment into the

exercises. With MILES, transmitters are mounted to the weapons, which emit lasers when

blank cartridges are fired. Sensors attached to the exercise participants detect the laser, and

determine if that player is “neutralized.” Prior to the integration of MILES into the FOF program,

responders would engage using “red guns” or mock weapons carried and aimed like real

weapons. Exercise controllers would determine the outcome of engagements by considering

factors such as distance, use of cover and concealment, and number of shots fired. 

Considerable artificialities were introduced to the evaluation with this engagement method. 

When used properly and with sufficient training, MILES equipment provides a much greater

degree of realism and reduces many artificialities of simulated combat. 

In order to ensure use of MILES equipment at all FOF inspections, the NRC acquired its own

dedicated MILES 2000 equipment which is maintained by the Department of Energy/National

Nuclear Security Administration (DOE/NNSA). DOE contractors transport the equipment to

each site and are responsible for distribution of the equipment and blank ammunition to each

security responder and adversary. These contractors, along with the NRC inspection team, are

important components of maintaining a safe and realistic exercise environment.4

An additional benefit of the MILES equipment maintained by DOE/NNSA is the After Action

Review capability. Data is downloaded from each exercise participant’s harness and can be

formatted into a spreadsheet to concisely summarize the engagement outcomes. 

If a licensee provides its own MILES, or equivalent ESS equipment, it may be used in lieu of the

NRC-provided MILES equipment if it: functions reliably; has comparable operational and safety

features to the NRC-provided MILES equipment; and is operated in accordance with written

guidance for the use and training of MILES equipment that, at a minimum, is equivalent to the
5

 Inspection Procedure 71130.03, “Contingency Response Force-on-Force Testing,” issued December 30, 2005.

6

 Office of Public Affairs “Backgrounder” on Force-on-Force.

Page 11 of 17

guidance used with NRC-provided MILES equipment. Prior to conducting FOF inspections,

inspectors verify that the licensees meet the established performance and safety requirements

in accordance with the inspection procedure and regulatory guidance. Through the end of CY

2005, three sites have used their own MILES or ESS equipment.5

Composite Adversary Force

A credible, well-trained, and consistent mock adversary force is vital to the NRC’s FOF

program. Previously, power plant operators had assembled adversary teams that frequently

included security officers from their own sites, other licensees, and state police tactical team

members. However, using these diverse sources caused inconsistencies in the capabilities of

the adversary team.

To improve the program, the NRC worked with the nuclear industry to develop a composite

adversary force (CAF) that is trained to standards issued by the Commission. The new

adversary force has been used for all FOF exercises conducted after October 2004. The CAF

has proven to be a significant improvement in ability, consistency, and effectiveness over the

previous adversary forces. The CAF is evaluated at each exercise using NRC performance

standards issued in April 2004. To date, the CAF has met the expectations of the NRC.

The CAF is primarily made up of employees from and managed by a company (The Wackenhut

Corporation (TWC)) that provides much of the security for U.S. nuclear power plants and is,

therefore, well-versed in the security operations of power plants. The NRC recognizes that

there may be a perception of a conflict-of-interest where the management company cannot

adequately test either the CAF or the plant security force. NRC established expectations for a

clear separation of functions within TWC and between the CAF and plant security forces to

ensure an independent, reliable, and credible mock adversary force. In addition, no member of

the CAF may participate in an exercise at his or her home site. These measures in aggregate,

serve to mitigate any potential conflict of interests as required by Section 651 of the Energy

Policy Act of 2005.

It is important to emphasize that the NRC designs, runs, and evaluates the results of the FOF

exercises. The NRC establishes the exercise objectives, boundaries, and timelines, and the

NRC and its contractors continually observe the performance of the CAF. The CAF carries out

the planned mock attacks, under the direction and guidance of the NRC. Should industry be

unable to maintain an adequate and objective CAF that meets the standards mandated by the

NRC, the NRC will take the necessary actions to ensure the effectiveness of the FOF

evaluation program.6

To date, there have been two complete CAF graduating classes, and three abbreviated classes

to supplement membership. Currently, the CAF consists of 73.3% TWC members, and 26.7%

non-TWC members. The contract ensures adequate non-TWC representation on the CAF.
Page 12 of 17

Inspection Procedure 71130.03 Revision

Throughout the first year of FOF inspections, the staff compiled lessons learned regarding both

the staff and licensees. Those lessons learned were subsequently fed back to all of the

inspection teams, as well as licensees and industry representatives to increase regulatory

stability and to ensure consistency throughout the inspections. FOF Inspection Procedure

71130.03, “Contingency Response Force-on-Force Testing,” was revised and issued on

December 30, 2005, to reflect process improvements and the lessons learned from the

previous year. Staff continues to compile lessons learned and will update the inspection

procedure and other regulatory guidance as needed. 

Improved Controller Training and Qualification

Controllers are a vital part of conducting safe and realistic FOF inspections. They are stationed

with on-duty forces and with mock player forces, ensuring that live weapons carried by the onduty forces are controlled during the exercise, that no live ammunition is brought into the

exercise field, and that the proper engagement determinations are made in an event where the

use of MILES may not be appropriate or situations when equipment malfunctions. In 2004, the

Commission directed the staff to work with industry to voluntarily implement improved controller

training and qualification. Since then, NRC staff has worked with the industry’s Nuclear

Security Working Group (NSWG) on the NRC’s expectations for such improved training and

qualification. As of the issuance of this report, industry has drafted a proposal for improved

controller training and qualification for NRC endorsement. 

Throughout the first year of inspections, staff has observed varying degrees of consistency

among licensee controllers. At one site, insufficient controller qualification caused exercise

results to be indeterminate. At other sites, NRC staff was able to validate the protective

strategy, despite controller performance issues. NRC recognizes the importance of improved

controller training and qualification, and is working to resolve recurrent issues with controllers. 

The Commission has directed staff to develop Orders to be issued to any licensee who does

not voluntarily implement an improved training and qualification plan for controllers.

Beyond the DBT and Technical Approaches to Beyond DBT

One of the ongoing enhancements to the FOF program is the planned integration of beyondDBT exercises. In late 2005, the Commission directed the staff to begin formally integrating

beyond-DBT testing into the FOF program on a voluntary basis for licensees, beginning with the

Joint Conflict and Tactical Simulation (JCATS) system.

JCATS is a Department of Defense (DOD) tool, developed by the Lawrence Livermore National

Laboratory, for simulating joint military exercises. It is also a useful tool for analyzing and

improving physical security. With its ability to model individual buildings accurately, obstructed

lines of sight, the time required to cut through walls or penetrate barriers, as well as its ability to

model interactions of individual entities, JCATS is well suited for evaluation of NRC licensees.

Since the middle of CY 2005, the NRC has been working with a DOD contractor to build site

models for each power reactor and CAT I fuel facility. The basic site models, which include

terrain features and building shells, have been completed for all power reactor and CAT I

facilities. In February 2006, staff demonstrated JCATS to the Commission, running scenarios

with fully completed models, including security features, fencelines, building floorplans, target
Page 13 of 17

set components, and unique adversary and responder characteristics. At the time of this

report, the staff has fully completed site models for one reactor and one CAT I facility. In FY

2006, staff will selectively enhance site models, and will begin to plan for the integration of

JCATS into the FOF program.

The Commission has also directed the staff to explore beyond-DBT testing for training in FOF

exercises by incrementally increasing numbers of adversaries. This beyond-DBT testing could

potentially be incorporated as an initiative completely separate from the inspection program, or

by substituting a beyond-DBT scenario for the third exercise of the inspection. The licensee

would only be given the option to substitute the third exercise with a beyond-DBT training

exercise provided that the protective strategy was demonstrated successfully, with margin, in

the first two exercises.

Indeterminate Exercise

NRC management will make the determination when less than three exercises are acceptable. 

This determination will be contingent upon: (1) at least two exercises having been conducted;

(2) both exercises having successfully demonstrated an effective protective strategy; and 

(3) no significant issues being identified. If those conditions are not met, the team may have to

expand the schedule or schedule a subsequent visit. If an exercise is deemed indeterminate or

is canceled due to severe weather, CAF management will wait for NRC confirmation before

leaving the site. NRC management will make the determination if the CAF team and NRC

inspection team will remain on site for any additional days to complete a third exercise. For a

licensee to demonstrate an effective protective strategy successfully, there must be a sufficient

number of armed responders, bearing the appropriate weapons, in protected positions, arriving

in time to neutralize a potential threat. Furthermore, the security force must know what to

protect, have a strategy for protecting those assets, and execute the strategy accordingly.

During a FOF inspection, a minimum of three FOF exercises are scheduled. However, due to

circumstances beyond the control of the on-site NRC inspection team, an exercise may have to

be canceled. For example, severe weather may result in an exercise being canceled due to

personnel safety considerations. There are occasions, when the NRC inspection team 

determines that an exercise may be deemed “indeterminate.” An indeterminate exercise is one

where the NRC inspectors are prevented from effectively gathering sufficient information to

evaluate the licensee’s protective strategy or to form a cogent conclusion. Examples of

indeterminate exercises include, but are not limited to; excessive safety or administrative holds,

insufficient exercise control, or extreme malfunctions of ESS equipment.

VII FOF Regulatory Program Activities

Between October 29, 2004 and December 31, 2005, FOF inspections were conducted at 

21 sites. One site was revisited during that time period, 5 months after the original FOF

inspection, because of performance issues. The first week of inspection activities was

completed at one site in August 2005, but the exercise week was postponed due to the impact

of Hurricane Katrina in the region. The inspection will be completed in the near future. An

inspection at another NPP included an additional exercise being observed by NRC

management and staff, after performance issues occurred during the FOF inspection.

From all of the inspections in this reporting period of the redesigned FOF program, there were

three findings. Table 2 below summarizes the first 23 inspections.
Page 14 of 17

Table 2 - CY 2005 FOF Inspection Program Results

Findings Number of

Facilities

Basis

No findings 18 N/A

Green NCVs 3 Inadequate Target Set Development

Controller issues

Performance Deficiencies During Exercise 1

Greater than Green 0 N/A

SL IV 0 N/A

Greater than SL IV 0 N/A

Rescheduled 1 Hurricane Katrina

Inspection Open 1 Findings under review

VIII FOF 2006 Planned Activities

FOF inspections are scheduled for 24 sites in CY 2006, including two Category I fuel cycle

facilities, one inspection at a site that was delayed due to Hurricane Katrina.

IX Disposition of Findings

Following the terrorist attacks of September 11, 2001, the NRC issued Orders and Confirmatory

Action Letters (CAL) containing requirements for compensatory measures enhancing the

security function. On September 11, 2003, the Compensatory Measures Management Review

Panel (CMMRP) was created to review all security inspection findings and ensure consistent

application and resolution of inspection findings. The panel membership includes NRC

Management from various NRC offices and the regional offices. In 2005, the panel name was

changed to the Security Findings Review Panel (SFRP) to reflect the current status of the

panel’s efforts to review and ensure NRC consistency for all security related findings, not just

findings concerning Commission directed Orders.

As with all security-related findings, findings that result from FOF inspections are reviewed by

NRC management in the SFRP. The panel consists of designated representatives from various

offices within the NRC as voting members, and others as appropriate to the issue. 

The purpose of the SFRP, like its predecessor, the CMMRP, is to ensure regulatory

consistency by reviewing and dispositioning findings, URIs, and potential findings resulting from

the inspection or observation of any licensees’ implementation of 10 CFR regulations, Orders,

physical security plans, technical specifications, and Confirmatory Action Letters. For NPPs,

this includes any and all findings related to the security cornerstone. Although the panel will

review and approve the approach to dispositioning an issue, applicable agency processes will

be used prior to issuance of any enforcement action.
Page 15 of 17

X Communications

As part of an effort to improve openness in communicating security information to the public, on

April 4, 2006, the Commission approved the recommendation of the staff to increase the

amount of public information released pursuant to the implementation of the Security Oversight

Process. For security-related inspection reports issued after May 8, 2006, the inspection report

cover letters will be released to the public with information of whether or not findings occurred. 

Guidelines are being developed to facilitate efficient staff assessments of making information

available to the public and are expected to be completed by July 2006.

In an effort to improve public awareness and understanding, the NRC has held two public

meetings specifically on nuclear security issues in August 2004 and September 2005. 

Additionally, security topics are presented at the NRC’s Regulatory Information Conference,

held annually in Rockville, Maryland. 

After each inspection, NRC staff gathers lessons learned in a variety of categories, including:

safety issues; protective strategy; MILES; CAF; controllers; qualification course of fire; target

sets; and exercise functional issues. Through the NSWG, a consortium of security

representatives from NRC licensed facilities, lessons learned are shared mutually between the

NRC and industry. The NSWG assists in disseminating information to the industry for the

combined goal of safe and realistic performance evaluations.

In most FOF inspections, representatives from local law enforcement agencies attend planning

activities and observe the exercise to improve understanding of the licensee’s response and

coordination of integrated response activities. Other representatives from state emergency

management agencies, state governments, the Government Accountability Office, Congress

and Senate have also frequently observed FOF inspections. 

XI Interagency Support

The NRC continues to support the U.S. Department of Homeland Security (DHS)/Homeland

Security Council (HSC) initiative to enhance integrated response planning for power reactor

facilities. In 2004, two Integrated Response tabletop exercises were completed. The staff is

continuing to work with HSC, DHS, Federal Bureau of Investigation (FBI) and others to develop

plans to address recommended actions. In addition, the staff is coordinating with other Federal

agencies and State and local security partners in the development of Emergency Action Levels

for all imminent threats.
Page 16 of 17

XII Reference List

1. NRC, “Backgrounder on Force-on-Force Exercises at Nuclear Power Plants,” 

http://www.nrc.gov/reading-rm/doc-collections/fact-sheets/force-on-force.html

2. NRC, “Protecting Our Nation,” NUREG/BR-0314, September 2004,

http://www.nrc.gov/reading-rm/doc-collections/nuregs/brochures/br0314/

3. NRC, “Weekly Information Report - Week Ending 12/2/05,” ADAMS accession number

ML053500054

4. NRC, “Frequently Asked Questions on Force-on-Force Security Exercises at Nuclear

Power Plants,” http://www.nrc.gov/what-we-do/safeguards/faq-force-on-force.html

5. Luis Reyes to Danielle Brian, Project on Government Oversight, regarding Composite

Adversary Force for Security Drills at Nuclear Power Plants, 9/30/04,

http://www.nrc.gov/reading-rm/doc-collections/for-the-record/2004/ltr-to-daniellebrian-po

go.pdf

6. NRC, “Response to Questions about Wackenhut and Public Access to Security Results”

http://www.nrc.gov/reading-rm/doc-collections/for-the-record/2004/nsir-response.pdf

7. NRC, “Weekly Information Report - Week Ending 12/2/05,” ADAMS accession number

ML053500054.
Page 17 of 17

XIII Acronym List

CAF .......... .......... .......... .......... ........ Composite Adversary Force

CAL .......... .......... .......... .......... .......... Confirmatory Action Letter

CAT I .......... .......... .......... .......... .......... .......... Category I

CFR .......... .......... .......... .......... ....... Code of Federal Regulations

CMMRP .......... .......... ..... Compensatory Measures Management Review Panel

CY .......... .......... .......... .......... .......... ......... Calendar Year

DBT .......... .......... .......... .......... .......... .... Design Basis Threat

DOD .......... .......... .......... .......... .......... . Department of Defense 

DOE .......... .......... .......... .......... .......... . . Department of Energy

DPO .......... .......... .......... .......... ...... Differing Professional Opinion

EFOF .......... .......... .......... .......... ........ Expanded Force-on-Force

ESS .......... .......... .......... .......... ........ Exercise Simulation System

FOF .......... .......... .......... .......... .......... ....... Force-on-Force

FY .......... .......... .......... .......... .......... .......... ... Fiscal Year

ISFSI .......... .......... .......... ..... Independent Spent Fuel Storage Installation

JCATS .......... .......... .......... ......... Joint Conflict and Tactical Simulation

MC&A .......... .......... .......... .......... ... Material Control and Accounting

MILES .......... .......... .......... . . Multiple Integrated Laser Engagement System

NCV .......... .......... .......... .......... .......... .... Non-Cited Violation

NEI .......... .......... .......... .......... .......... . . Nuclear Energy Institute

NNSA .......... .......... .......... .......... . . National Nuclear Security Agency

NPP .......... .......... .......... .......... .......... ... Nuclear Power Plant

NRC .......... .......... .......... .......... .... Nuclear Regulatory Commission

NSIR .......... .......... .......... . Office of Nuclear Security and Incident Response

NSWG .......... .......... .......... .......... . . Nuclear Security Working Group

PPSDP .......... .......... .... Physical Protection Significance Determination Process

ROP .......... .......... .......... .......... ........ Reactor Oversight Process

SDP .......... .......... .......... .......... . . Significance Determination Process

SFRP .......... .......... .......... .......... .... Security Findings Review Panel

TFOF .......... .......... .......... .......... ....... Transitional Force-on-Force

TWC .......... .......... .......... .......... ....... The Wackenhut Corporation

URI .......... .......... .......... .......... .......... ........ Unresolved Item