QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

NOTE: A number of questions received by the NRC as a result of the Webinars had been previously asked and aCommission during the rulemaking process for the Safeguards Information (SGI). Where applicable, those commare noted by citation in the responses below. The staff has carefully examined these questions and reviewed the ensure that its answers are consistent with the Commission's responses in the rulemaking. However, to the extenany inadvertent conflict, stakeholders should note that the Commission's statements in the rulemaking record govthe rule. For reference, stakeholders can obtain copies of the various rulemaking documents by following the web Final Rule (October 24, 2008): http://edocket.access.gpo.gov/2008/pdf/E8-24904.pdf. 

Revised Proposed Rule (October 31, 2006): http://edocket.access.gpo.gov/2006/pdf/06-8900.pdf. 

Proposed Rule (February 11, 2005): http://edocket.access.gpo.gov/2005/pdf/05-2665.pdf. 

Related To Question and Answer

1. Guidance Q: Will the issued rules effective 2/23/09 and requirements supersede the Site specific O

A: No. The orders will remain in effect until the Commission relaxes the requirements oin part. During this time, order recipients are obliged to comply with both the rule and the instances when the rule and an order appear to conflict with one another, the more stringbe applied. Order recipients who have any question regarding the appropriate measures consult with the NRC staff immediately. 

2. Guidance Q: If a specific extension is applied for prior to the effective date, will the licensee be in v

regulation while NRC is determining if the extension will be granted? A: Yes. Until the exemption is granted, the licensee is obligated to comply with the rule

3. Guidance Q: Will the designation guide, marking guide, and standard practices and procedures gu

draft reg. guide? If not, why not? 

A: As a practical matter, the safeguards information designation guide will remain as a sis not a legally enforceable document. However, the guidance described in that documesupport an enforcement action if appropriate. The safeguards information designation gpersonnel in properly identifying and designating safeguards information that they are obdetail and policies that are addressed in key guidance documents such as the safeguardregulatory guide and standard practices and procedures are subject to change as dictateor regulatory requirement. Merging the key guidance documents could cause a significachanges are required for one component of the composite document. Stakeholders wouwith the key guidance document existing independently of one another. The determinatidisposition of the safeguards information marking guide and standard practices and procbeing evaluated. Given that the documents are in different stages of development, they stand-alone documents as they are finalized. At any rate, the guidance documents will buse to all licensees, applicants and certificate holders. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

4. Definition Q: Ref 73.22(a)(1)(ii) - Please provide criteria associated with the use of the term "easily 

A: The Commission responded to a similar comment during the SGI rulemaking. Stakereference page 64039 of the Revised Proposed Rule. In sum, the phrase ‘‘not easily disthe public’’ was added to reflect the aspects of a licensee’s or applicant’s physical securireadily observed by members of the public are not necessarily considered SGI. 

5. Definition Q: For engineering information determined to be SGI. At what point would engineering d

systems be considered SGI? And would the employees of the design firm then need to granted access to SGI? Thank You. A: This issue was addressed by the Commission in both the revised proposed rule and 63556 of the Final Rule and 64017 of the Revised Proposed Rule. Sections 73.22(a)(1)73.23(a)(1)(ii) and (xii) describe the types of information that must be protected in this reprovide criteria to be used by the creator of those documents to determine whether or nodocument contains Safeguards Information. The NRC staff notes, however, that the “enanalyses” that must be protected must be specifically tied to site specific, security related 73.22(a)(1)(ii) is tied to security related site-specific drawings, diagrams, sketches etc. threpresent the final design feature of the physical security system. Stakeholders should cDesignation Guide and the NRC staff if there is doubt as to whether a specific document 

Information. 

6. Transportation Q: The information in the Federal Register seems to conflict between the guidance and t

comments as follows: Current Code language in the Federal Register: § 73.23 ProtectioInformation—Modified Handling: Specific Requirements..... ; manufacturers and distributsource material, or byproduct or special nuclear material in greater than or equal to Cateconcern; transportation of more than 1000 Tbq (27,000 Ci) but less than or equal to 100 nuclear fuel;..... research Comments and Response: According to the commenter, it is unclear how the originator 2 will be able to assure that each carrier meets the requirements to handle SGI–M. RespCommission has determined that information relating to the transportation of Category 2 protected as SGI–M and may be shared on a ‘‘need-to-know’’ basis. Does Cat 2 count a
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

A: The Commission responded to a similar comment during the SGI rulemaking. Stakereference the Final Rule at 73 FR 63555-63556. In sum, as noted previously by the Comrulemaking, and as clearly stated in the text of the rule at 10 CFR 73.21(a)(1)(ii), informathe transportation of IAEA Category 2 radioactive material is not required to be protected information-modified handling. However, this information is considered by the Commissinformation. Licensees are expected to protect such security related information from unand limit access to those individuals that have a need to know. However, stakeholders srequirements would apply to licensees possessing Category 2 radioactive material to the materials are possessed by panoramic and underwater irradiators or manufacturers and forth in the introductory paragraph of 10 CFR 73.23. 

7. Transportation Q: Do we need to Safeguard all information utilized in making dry cask movements? 

A: No. The protection of security information for dry cask storage or movements is similatransportation in that some of the components of dry cask movements are public informaby the public. The NRC has developed and issued a SGI Designation Guide to assist licstakeholders in determining what information should be protected as SGI. In short, inforassist an adversary in developing or carrying out an attack would be considered SGI. 

8. Transportation / 

Access 

Q: Are these non Power Reactor stakeholders going to have a data base such as PADS verify status of individuals? A.: The NRC does not own, operate nor control the Personnel Access Data System. Th

Data System is not a tool that’s used to verify access to safeguards information. The Coimmediate plans for requiring a PADS-type of database for stakeholders to use to verify individuals. 

9. Access Q: Under the new rule, can anyone establish an SGI program without obtaining NRC ap

A: Yes, anyone can establish a safeguards information protection system, but the estabdoes not mean that it necessarily complies with the requirements of the rule, Further, thsafeguards information protection system also does not mean that the establisher will be SGI. An adequate SGI protection program is merely one component of the rule’s requirecomplimented with a need-to-know determination by the holder of the SGI, and satisfactelements of the background check requirement before one gains access to safeguards i
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

10. Access Q: There is no specific or implied expiration or required update to these background che

there in doing this SGI background once and not doing it again at some period? The way background once and carry it on the books indefinitely. A: There is no reinvestigation requirement in the regulation for continuing access to SGIregulations at 10 CFR 73.22(b) and 73.23(b) require that persons with access to Safegube trustworthy and reliable, based on a background check...” As noted by the CommissRevised Proposed Rule (71 FR 64004, 64014), this implies that there is a continuing obland others responsible for allowing access to Safeguards Information to make reasonabbest judgment to ensure that persons whom they allow access to Safeguards Informatiotrustworthy and reliable. 

11. Access Q: If you already have prints on file and have verified that individual’s identity, can yo

PHQ from NEI and not have to re-verify their ID at that time. (I have some individuimmediate area and they would have to travel to verify their ID.) A: If the fingerprints on file have previously been submitted to the FBI, through the NRCaccomplish that element of the background check requirement. Use of the PHQ from NEwill satisfy the other elements of the background check requirement. 

12. Access Q: What adjudication standards are to be used when reviewing FBI Criminal History rep

A: The NRC’s requirements do not prescribe specific disqualifying criteria for a criminal for access to safeguards information. Licensees are expected to use their best judgmendetermining on a case by case basis which individuals are trustworthy and reliable and taccess to Safeguards Information. Reviewing officials however, must be judicious in the

trustworthiness and reliability determination such that disclosing safeguards information the subject of the trustworthiness and reliability determination) does not constitute an unpublic heath and safety or common defense and security. 

13. Access Q: Will individuals with existing government issued security clearances, such as DOE or 

from the background investigation requirement? If so, what will be the expected documemaintained to support this exception? A: No additional fingerprinting is required for access to safeguards information for individactive Federal security clearance. The fact that those individuals have an active Federameets the fingerprinting and other elements of the background check requirement as pre73.22 and 73.23. When an active Federal security clearance is used to meet the fingerpelements of the background check requirement, the Reviewing official must maintain a renotification stating that the individual possesses an active Federal security clearance. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

14. Access Q: Is a credit check a necessary part of a "reliability and trustworthiness" determination u

What about psychological screening? A: No. The basic requirement for a background check is based upon a Federal Bureau criminal history records check (including verification of identity based on fingerprinting), eeducation, and personal references. The background check portion for access to SGI reeducation be verified as part of the trustworthiness and reliability determination. The suieducation to their job responsibilities is considered a key attribute in determining a persoreliability. With respect to personal references, the rule does not differentiate between sreferences and developed references. The trustworthiness and reliability determination results of the background check and the individual characteristics of the individual. The check and reviewing official must have a level of assurance that the procedures used to of the background check are sufficient to make an informed trustworthiness and reliabilitAdditionally, psychological screening is not a prerequisite for access to SGI 

15. Access Q: May the Industry utilized PADS to store and track SGI Background Checks and FBI C

(this would be for those personnel who have not applied for Unescorted Access)? A: The NRC can not make policy for a database that it does not own nor operate. Howerestrictions regarding the dissemination of criminal history record information in Section Energy Act and 10 CFR 73.57(f), such information cannot be placed in a shared databasLicensees and stakeholders must in all instances comply with the protection requiremen73.57(f). 

16. Access Q: You mentioned acceptance of confirmation of fingerprints or background information t

agencies for credit towards background investigations. Are e-mails from NRC, DHS, DOPADS coordinator, other licensees, etc. sufficient for confirmation, in lieu of letterhead m

get an e-mail from NRC ADM/DFS/PSB, it should suffice to confirm and credit for whethe

fingerprints on record, or what kind of current clearance they have, etc. It may even be oattachment, etc. A: Confirmation of an active Federal security clearance may be made in several forms. that confirmation is transmitted and/or received is dependant upon the organization or agcommunicating the information. Typically, Federal Agencies do not rely upon the use of active Federal security clearances. Compliance with guidelines associated with the protinformation must always be at the forefront when sharing such sensitive data. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

17. Access Q: 2 forms of photo ID are restrictive with respect to most individuals. What other forms 

ID (other than driver's license) would be acceptable? A: That would depend on the purpose for the identification verification. Since no indicapurpose of the identification verification, the assumption is that the effort is related to a fiJurisdictions across the country have various requirements for identification as it relates Typically, they rely upon government issued credentials that state physical characteristiclicense, a passport or a Federal, State or Tribal issued identification card. Some jurisdicexpansive list of identifications credentials that are accepted for the purpose of fingerprinbe very restrictive in what can be accepted. 

18. Access Q: If an SGI cleared employee changes employers i.e. Moves from licensee to licensee 

licensee or licensee to NEI, for example, do they have to go through the process again, previous SGI requirements having been met? A: NRC regulations at 10 CFR 73.57(b) clearly address this question. As explained in thlapse in time since the person’s last access to Safeguards Information must be taken intshould information as to whether the access was terminated under favorable condition, bmade to accept the trustworthiness and reliability determination from a previous employemakes allowance for the acceptance of fingerprints of an employee of a licensee, contrasupplier that has been granted access to a nuclear power facility or to safeguards informbased in part on a criminal history records check. The criminal history check file may be gaining licensee in accordance with the provision of 10 CFR 73.57(f)(3). The reviewing all elements of a background check have been conducted and make a trustworthiness adetermination based upon the information made available to him or her. 

19. Access Q: If an empoyee has been with the same employer for a number of years, say 8 or 10 y

cleared under the old Rule, was finger printed many years ago; what new activity is expedone to meet the new Rule requirements? A: The rule does not require new fingerprinting of employees with existing access to SafHowever, if the employee has not been the subject to other elements of the new backgroemployment history, education history and personal references as prescribed by 10 CFR 73.23(b), he or she would have to undergo a background check for those elements alone trustworthy and reliable based on all of the information obtained as a result of the backgrcontinue to have access to SGI. Until all of those elements are completed, individuals shto Safeguards Information. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

20. Access Q: Was the intent of the Regulator to follow the current AA model? 

A: No. The requirements for unescorted access to an NRC regulated facility are more staccess requirements for SGI. However, as explained by the Commission in the 2006 Re(71 FR 64004, 64014), because the requirements for a background investigation for uneNRC regulated facility include all of the elements of a background check for access to SGcurrently has unescorted access under these programs should be considered suitable foInformation, assuming the individual has been determined to have a “need to know.” Thfor the two access requirements to conflict or cause an unnecessary burden on licensee

21 Access Q: At FENOC we are using the current Access Authorization requirements for unescorte

background requirement. How are others in the industry going to meet and document ththe Access Authorization group at their Sites? A: The commenter should note the response to Question 20 above. In short, persons wunescorted access to operating nuclear power plants pursuant to an access authorizatioNRC’s regulations at 10 CFR 73.56 can be determined to be sufficiently trustworthy and access to Safeguards Information. The background check requirements for access to S(SGI) were not intended to be more comprehensive or restrictive than what is required foa commercial nuclear power plant. 

22. Protection while in use or storage 

Q: Why would the NRC consider additional controls for thumb drives that contain encrypthe same information is allowed to be transmitted electronically (i.e., encrypted)? A. Removable magnetic medium, used to store Safeguards Information, must be properin a security storage container when not in use. The rule makes no distinction between tsafekeeping requirement for encrypted safeguards information on removable magnetic mmarking and safekeeping requirements for unencrypted safeguards information on remodevices. 

23 Marking Q: It appears that the portion marking requirement, in the new rule, is limited to transmit

an accurate assessment? A: Yes. The new rule has relaxed the portion marking requirements that were evident in of the rule. Portion marking is only required for correspondence to and from the NRC (i.eattachments) that contain safeguards information. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

24 Marking Q: The addition of marking 1st page of SGI document, how is that being applied to histo

are vaulted as for example previous revision to PSP's and electronic media ? A: The Commission noted, in the statements of consideration of the final rule, that it doeor applicants to go back and mark documents for which a cover sheet was used for the rinstead of the first page of the document as set forth in 10 CFR 73.22(d)(1). (73 FR 635documents that are vaulted need not be removed from the vault solely for the purpose of requirement. As those documents are removed from the vault for use, i.e. transmitted, mattachment, they must be marked as required. That is to say, markings must be conspicfirst page of the document. If the first page of the document is the cover page, then the would be conspicuously place on the cover page/first page. When a transmittal letters is safeguards information document, and is not a permanent part of the document, the actusafeguards information document itself must be marked according to 10 CFR 73.22(d) aAdditionally, the rule makes no distinction, with respect to the marking of electronic docudocuments or other matter containing safeguards information. Documents or other mattsafeguards information must be marked according to 10 CFR 73.22(d) and 73.23(d). 

25 Marking Q: Is it possible for a materials licensee (such as an M&D) to mark information as SGI-M 

as SGI? A: The regulations clearly define in paragraphs 73.22(a) and 73.23(b) what information Safeguards Information or Safeguards Information-Modified Handling, respectively. MatManufacturers and Distributors are, by regulation, subject to the safeguards information-requirements set forth in 73.23. 

26 Marking Q: Containers cannot be identified as containing SGI...what about rooms, individuals ca

we require those with SGI to keep it in bright pink folders and to wear a badge indicating of SGI. These are visual reminders to assist the individual in maintaining control). A: Security storage containers cannot be marked to indicate that they house safeguards locked security storage containers to indicate they contain SGI may assist in identifying troom has security storage containers and those security storage containers house safegmarking of the room to indicate that it holds safeguards information would violate the spiand should not be done. The use of devices that strengthen day-to-day information secuas the use of bright pink folders or the wearing of a particular badge is permissible and ssecurity enhancer. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

27 Marking Q: 73.22(h) discusses who can decontrol SGI. We are assuming that a licensee can de

have created or material created by others with their approval. A: That is correct, but care must be taken to ensure that documents or other matter that meet the criteria for continued designation as safeguards information and not disclose sain some other form or be combined with other unprotected information to disclose safegu

28 Safekeeping and Storage 

Q: Is the use of an encrypted volume within a stand-alone computer (i.e. double passwowithin a controlled access area an acceptable alternative to the new rule language? A: No. The rule is specific in its requirement for the protection of safeguards information processed or produced on electronic systems. Controlled access area is not synonymoucontainer and the rule makes no assertion that encryption is comparable to or a substitutcontainers. A controlled access area can be accredited for open storage of safeguards ithat accreditation by NRC, safeguards information must be stored in a security storage cuse. 

29 Safekeeping and Storage 

Q: Is the practice of carrying encrypted SGI on a flash drive acceptable? Some people Webinar that this would not be allowed under the new rule which makes little sense with email encrypted information. A: Safeguards information may be saved to removable storage medium, and while unatstorage medium must be stored in a security storage container. When removable storagstore safeguards information, users must ensure that the medium is properly marked to of safeguards information as prescribed by 10 CFR 73.22(d) and 73.23(d). 

30 Safekeeping and Storage 

Q: Is the practice of carrying unencrypted SGI on an encrypted volume in a dedicated ha

A: If your question is with respect to transporting the hard drive from an authorized place hard drive can be used to transport safeguards information if the hard drive is properly mas perscribed by 10 CFR 73.22(f) or 73.23(f). 

31 Reproduction Q: Can we get a list of government approved copier memory purge software good for us

A: Such a list is unavailable at this time, but we will continue to research this issue and r

interested parties as soon as possible. 
QUESTIONS RAISED DURING THE FEBRUARY 2009 WEBINAR SESS

32. Transmission Has NRC considered modifying Section 73.22(g) to permit the secure electronic transfer 

information from a computer with an internet connection? The requirements of 73.22)f) acontradict one another. Clarification is needed. A: Sections 10 CFR 73.22(g) and 10 CFR 73.22(f) both address transmission of safegurequirements. 10 CFR 73.22(f) states that safeguards information must be transmitted tsecure electronic devices. It also states that safeguards information may be transmitted provided that the information is compliant with Federal Information Processing Standard encryption that has been approved by NRC. FIP 140-2 has four levels and one of the foadopted for used and that choice forwarded to the NRC for approval. 10 CFR 73.22(g) addresses the use of stand-alone computers when safeguards informaprocessed or produced. Safeguards information that is stored, processed or produced ocomputer can be encrypted, using NRC approved FIPS 140-2 or later methods, then migconnected computer for the purpose of transmission through electronic mail. The interneis merely a transmission and receipt device for a FIPS 140-2 or later compliant encrypte

33. Transmission Q: 73.22(f)(2) discusses external transmission of documents. This appears to be discus

documents outside of our company, not within our company. Does this mean that when documents that have been properly sealed in double envelopes within our company, bulocations which could be in different cities or states, we have to use these commercial cacannot use our inner company mail system that does not have individual tracking? A: Computer tracking capabilities are necessary to aid in quickly determining the locatiothat the risk of unauthorized disclosure may be minimized. If the inner company mail syspersonnel that are authorized access to safeguards information pursuant to the access r73.22(b), then you need not rely upon commercial delivery companies that provide servitracking features, U.S. first class, registered, express, or certified mail. The procedures transmission of safeguards information must comply with the requirements of 10 CFR 73