1

Draft Technical Basis for a Rulemaking to Revise the 

Security Requirements for Facilities Storing Spent Nuclear Fuel and 

High-Level Radioactive Waste, Revision 1 

[NRC-2009-0558] 

A The Objectives of this Rulemaking 

The Nuclear Regulatory Commission (NRC) is initiating this rulemaking to revise the existing 

security requirements in 10 CFR Part 73, “Protection of Plants and Materials,” that apply during 

the storage of spent nuclear fuel (SNF) at an Independent Spent Fuel Storage Installation 

(ISFSI) and during the storage of SNF and/or High Level Waste (HLW) at a Monitored 

Retrievable Storage Installation (MRS). This rulemaking will also make conforming changes to 

the ISFSI and MRS licensing requirements in 10 CFR Part 72, “Licensing Requirements for the 

Independent Storage of Spent Nuclear Fuel, High-Level Radioactive Waste, and ReactorRelated Greater Than Class C Waste.” The NRC’s specific objectives for this rulemaking are 

to: (1) update the ISFSI security regulations to improve the consistency and clarity of Part 73 

regulations for both types of ISFSI licensees (i.e., general and specific), to reflect current 

Commission thinking on security requirements, and to incorporate lessons learned from security 

inspections and Force-on-Force (FOF) evaluations conducted since these regulations were last 

updated; (2) to make generically applicable requirements similar to those imposed on ISFSI 

licensees by the post-9/11 security orders; and (3) to use a risk-informed and performance 

based structure in updating the ISFSI and MRS security regulations. 

Objective One – Consistency

 

The first objective has three components and is to propose a set of security requirements that 

will achieve consistent outcomes across the wide range of SNF and HLW storage facilities that 

either exist today, or could be licensed by the NRC under Part 72 in the future. The existing 

ISFSI and MRS security regulations in Part 73 are unnecessarily complex; have not been 

updated in more than a decade; and are difficult for the NRC staff, licensees, applicants, and 

other stakeholders to understand and apply. Moreover, these regulations are required to 

address a large number of variations, for example, the presence of both general- and specificlicense ISFSIs; whether an ISFSI is stand alone or the ISFSI is collocated with a nuclear power 

reactor; and for a collocated ISFSI, whether the ISFSI is located inside or outside of the 

reactor’s protected area. Additionally, the NRC has previously imposed different security 

requirements under Part 73 for different groups of ISFSIs (e.g., § 73.51 for an away from 

reactor ISFSI and § 73.55 for an ISFSI that is collocated with an operating reactor). 

Accordingly, one of the NRC’s principal objectives of this rulemaking is to create a more 

consistent and coherent regulatory structure for these types of waste storage facilities; and 

thereby improve agency transparency, regulatory clarity, and the ease of use of these 

regulations. 

The second component of the first objective is to propose security requirements that are 

consistent with the Commission’s recent final rule updating the security requirements for 

nuclear power reactors (see 74 FR 13925; March 29, 2009). Where possible, the NRC intends 

to propose identical security requirements to those used in this recent reactor security rule. 

However, where this is not possible (e.g., constraints exist due the differing nature of these two 

types of facilities, differences in their physical protection programs, and differences in the 

applicable threat), the NRC intends to propose requirements that are functionally equivalent. 

An example of consistent regulations would be the requirements for protected area barriers the 

use of deadly force, and alternative measures. 
2

The third component of the first objective is to propose security requirements that address 

lessons learned during the course of previous NRC inspections and FOF exercises held since 

the ISFSI security regulations were last updated; and lessons learned during licensing reviews 

of all of the power reactor security plans that were conducted in 2003 and 2004 (following the 

issuance of security orders to reactor licensees). An example of an inspection/FOF input the 

NRC is proposing to address is in the application of vehicle barrier systems to the SNF transfer 

pathway between the reactor and a collocated ISFSI with a separate protected area. 

Objective Two – Generic Applicability of Security Orders

The second objective is to make generically applicable the appropriate provisions of the security 

orders issued by the NRC to ISFSI licensees following the terrorist attacks of September 11, 

2001. In the aftermath of these attacks, the NRC developed security orders containing interim 

compensatory measures (ICMs) that were applied to existing dry and wet ISFSIs. However, 

these orders were only issued to existing ISFSI licensees and new licensees as they prepared 

to load SNF. Additionally, in 2007 the NRC updated the ICMs and retitled them as additional 

security measures (ASMs) and issued them with subsequent ISFSI security orders. The ICMs 

and ASMs contained measures that were controlled as Safeguards Information. The NRC is 

proposing to make provisions of these orders generically applicable in the proposed rulemaking 

and thus to decontrol non-sensitive requirements to increase agency transparency and 

regulatory clarity. Additionally, measures such as vehicle barrier systems would be added to 

the regulations in part 73. Finally, the NRC would also address lessons learned in inspecting 

the imposition of these security orders. The agency’s long-term objective is to sunset these 

security orders after a final rule is issued, licensees have implemented the revised regulations, 

and the NRC has inspected a licensee’s implementation of the revised regulations. 

Objective Three – Use a Risk-Informed and Performance Based Structure

Historically, the NRC’s development of security regulations for ISFSIs and MRSs has taken 

credit for the typical robust design features of SNF dry storage facilities. These facilities 

typically are massive structures that use steel and/or concrete to provide protection against 

radiation and against the release of radioactive materials due to design-basis accidents (e.g., 

drops during handling or movement, earthquakes, or tornado missiles). Because of this high 

degree of protection afforded by these massive structures for design basis accidents, the NRC 

has required ISFSI licensees to implement moderate security measures and a "detect, assess, 

and communicate" protective strategy that was appropriate to the risk of malevolent acts 

releasing radiation or radioactive material. Because of their greater risk of releasing radioactive 

material, the NRC has required power reactor licensees to implement extremely robust security 

measures and a "denial of task" protective strategy. A denial protective strategy requires the 

licensee’s armed security personnel to interpose themselves between any adversaries and to 

use force, including deadly force, to neutralize any adversaries (i.e., to prevent the adversaries 

from reaching and destroying their targets). In contrast, ISFSI and MRS licensees 

implementing a "detect, assess, and communicate" protective strategy are required to contact 

their nearby local law enforcement agency (LLEA) and request that LLEA respond to the site. 

LLEA personnel are responsible for apprehending/neutralizing any adversaries. As may be 

expected, the length of time necessary for LLEA to accomplish this task is significantly longer 

than for the licensee’s armed security personnel implementing a “denial” protective strategy. 

Following the events of September 11, 2001, the NRC completed security assessments for a 

range of NRC-licensed facilities. For ISFSIs, the NRC’s assessment was completed during 
3

2003 to 2005 time frame and evaluated several types of dry storage casks designs that were 

viewed as being representative of the entire population of dry storage ISFSIs. These 

assessments evaluated both attacks using large aircraft and ground assaults using a variety of 

methods. The assessments generally concluded that no significant overall facility vulnerabilities 

were identified and thus no immediate changes in the security requirements for ISFSIs were 

necessary to ensure adequate protection of public health and safety. However, the 

assessments did challenge previous NRC conclusions on the ability of a malevolent act to 

breach shielding and/or confinement barriers and thus release radiation or radioactive material; 

and indicated that increased security requirements were warranted for specific scenarios such 

as these. Since these assessments discuss vulnerability information; and thus could be used 

as potential targeting tools, they are not publicly available. 

In response to this new information and in recognition of regulatory challenges previously 

discussed, the NRC staff developed Commission policy paper SECY-07-0148 to update the 

ISFSI security requirements (redacted version of this policy paper is publicly available under 

ADAMS package no. ML080030050). The Commission directed the NRC to proceed with the 

development of a proposed rulemaking that uses a risk-informed and performance-based 

approach. In this approach, licensees would be required to calculate the onsite and offsite 

radiological dose consequences from the potential release of radioactive material from their 

storage facility, due to certain “security scenarios” specified by the NRC. Licensees would be 

required to verify that the dose from applicable scenarios would not exceed a 0.05-Sievert (Sv) 

(5-Rem) collective dose limit at the controlled area boundary. The requirement for licensees to 

specify a controlled area boundary and to meet a “5-Rem” dose limit for design basis accidents 

is specified in the current 10 CFR 72.106.1

 Therefore, the NRC is proposing to establish a 

security based dose limit in Part 73 that has the same values as found under the current 

10 CFR 72.106 

 

Licensees would use the information supplied by the NRC in combination with information 

specific to their facility (e.g., distance from the ISFSI or MRS to the controlled area boundary, 

specific storage cask type, specific fuel burnup (i.e., radionuclide inventory), and distance to the 

facility’s site boundary) to calculate the potential dose and to verify that a 0.05-Sv (5-Rem) dose 

limit to be included in Part 73 has been met. The NRC envisions that licensees would use an 

iterative process that considers changes to parameters (e.g., distance to the controlled area 

boundary) in order to meet the 0.05-Sv (5-Rem) security dose limit. Licensees who could not 

meet the 0.05-Sv (5-Rem) dose limit (either with their current facility or by expanding the 

controlled area boundary of their facility) would be required to consider other options. These 

options could include increasing the size of the licensee’s facility, using engineered security 

barriers/features to prevent a specific “security scenario,” if possible, or shifting to a “denial” 

protective strategy to prevent the specific “security scenario” from succeeding. 

 

The NRC is proposing to use a "risk-informed and performance-based" approach to help define 

a new regulatory structure for ISFSI security activities. The "risk-informed" element would apply 

a vulnerability assessment methodology against ISFSIs that is informed by both the intelligence 

community's developed threat stream and by vulnerability information that is not threat based 

(i.e., the evaluation of whether ISFSIs may be vulnerable to certain specific weapons effects for 

which an underlying threat stream does not currently support their inclusion under the DBT for 

 

1 The dose criteria in 10 CFR 72.106 includes separate limits of 0.05 Sv (5 Rem) total effective dose equivalent; 

0.15 Sv (15 Rem) to the lens of the eye; and 0.5 Sv (50 Rem) as either the sum of the deep dose equivalent and any 

organ dose, or the shallow dose equivalent to the skin or any extremity. Collectively, these values are hereinafter 

referred to as the 0.05-Sv (5-rem) dose limit.
4

radiological sabotage). The "performance based" element would apply specific radiological 

dose acceptance limits to ISFSI security activities. This combined approach would provide 

licensees flexibility in crafting an appropriate security regulatory structure for ISFSIs that may be 

different than that used for power reactors and would provide clear and objective performance 

standards. This new approach would recognize that the security regulatory structure applied to 

ISFSIs may be appropriately different from the security regulatory structure applied to power 

reactors, due to significant differences in: (1) the designs of these two types of facilities; (2) the 

nature of their security vulnerabilities; (3) differences in the physical and regulatory approaches 

used to create defense-in-depth for these facilities; and (4) differences in the nature and size of 

a potential radiological release from these facilities. 

The NRC views this proposed regulatory structure as affording current ISFSI licensees and any 

future ISFSI or MRS licensees with the greatest amount of flexibility in meeting the regulations; 

while ensuring the public and other stakeholders that all ISFSI and MRS facilities meet a 

specific and consistent standard for protecting public health and safety, the common defense 

and security, and the environment. This proposed regulatory structure is also consistent with 

the historic NRC regulatory model that requires licensees to demonstrate compliance with the 

NRC’s regulations, and minimizes licensee fee costs and the impact on staff resources. 

Additionally, this approach provides consistency for the differing types of ISFSI licensees, and 

also provides a metric that is independent of future fuel loading characteristics and dry-cask 

storage designs. This approach also provides increased protection of Safeguards Information 

from unauthorized disclosure. The licensee's assessments that their ISFSI is in compliance 

with the 0.05-Sv (5-Rem) dose limit would be subject to review and/or inspection by NRC staff, 

as appropriate. 

The NRC recognizes that some licensees, who are constrained by the footprint of their site, 

might have to implement a denial strategy for their ISFSI under this rulemaking. Alternatively, a 

licensee might conclude that the total life-cycle security costs associated with implementing a 

denial strategy at its ISFSI outweighs the transportation costs; the incremental change in lifecycle security costs associated with storing the extra SNF at an ISFSI implementing a detect, 

assess, and communicate strategy; and the licensing costs of such shipments. In such cases, 

the NRC recognizes that a licensee could conclude that shipment of SNF and storage at 

another ISFSI may incur lower costs. However, regardless of the location used to store the 

SNF, the NRC’s goal in this rulemaking is to ensure that an adequate and consistent level of 

protection is afforded at all ISFSIs. 

The NRC notes that existing licensees currently have the option to transport their SNF to 

another ISFSI or MRS. A request to transfer SNF to another ISFSI would require a license 

amendment for the receiving facility (either the Part 72 specific or general ISFSI licensee). 

Furthermore, such transportation of SNF would be required to comply with the NRC’s safety 

requirements in 10 CFR Part 71, “Packaging and Transportation of Radioactive Material” and 

the NRC’s security requirements for the transportation of SNF in 10 CFR 73.37, “Requirements 

for Physical Protection of Irradiated Reactor Fuel in Transit.” 

In implementing this new risk-informed and performance-based approach for ISFSI and MRS 

security, the NRC would discontinue the application of the design basis threat (DBT) for 

radiological sabotage to general license ISFSIs. The current regulations in 10 CFR 73.1(a) only 

apply the DBT for radiological sabotage to general license ISFSIs.2

 This is an example of 

 

2 Final rule - 10 CFR Part 73, "Design Basis Threat." Published in the Federal Register on March 19, 2007 

(72 FR 12705).
5

inconsistent treatment of ISFSIs and MRSs. The Commission had previously indicated that the 

issue of whether or not to apply the DBT for radiological sabotage to all ISFSIs (and thus to 

MRSs as well) would be addressed in a future rulemaking. 3 This proposed rule would address 

this issue by not applying the DBT for radiological sabotage to any ISFSIs or MRSs. 

In developing this approach, the NRC staff also considered the findings and recommendations 

contained in the National Academy of Sciences’ (NAS’) National Research Council report on 

“Safety and Security of Commercial Spent Nuclear Fuel Storage: Report to Congress,” dated 

July 2004 (particularly those findings and recommendations contained in sections 4 and 5 of the 

NAS report). The NRC staff also considered the Commission’s report to Congress on the 

National Academy of Sciences’ National Research Council report on “Safety and Security of 

Commercial Spent Nuclear Fuel Storage,” dated March 14, 2005. Both these reports contain 

classified national security information and are not publicly available. In 2006, the NAS 

published a redacted version of this study titled “Safety and Security of Commercial Spent 

Nuclear Fuel Storage: Public Report.” This study is available from NAS for a fee (see the NAS 

website at http://www.nap.edu/catalog.php?record_id=11263#toc to obtain a copy of the public 

report). The NAS study was based, in part, upon the results of the NRC’s security assessments 

described above. 

Petition for Rulemaking (PRM-72-6), Item 11 – Hardened On-Site Storage

Petition for rulemaking (PRM-72-6),4

 Item no. 11, requests that the NRC “... require Hardened 

On-site Storage (HOSS) at all nuclear power plants as well as away-from-reactor dry cask 

storage; that all nuclear industry interim on-site or off-site dry cask storage installations or 

ISFSIs be fortified against attack.” The technical content of Item no.11 appears to be relevant 

to this rulemaking updating ISFSI and MRS security requirements. The petitioner also quoted 

from the 2006 NAS public report mentioned above in support of their position. 

As discussed previously, the NRC is proposing to require ISFSI and MRS licensees to calculate 

potential dose consequences arising from certain security scenarios. If these results exceed 

the 0.05-Sv (5-Rem) dose limit, then a licensee could use engineered security features to fortify 

the ISFSI or MRS against attack, or implement a denial protective strategy. Consequently, 

while the use of HOSS could be a engineered security solution to the dose analysis results for a 

particular facility, the NRC has not concluded that the use of HOSS should be mandated at all 

ISFSIs or MRSs. However, because item 11 raises issues that are relevant to this rulemaking, 

the NRC would consider addressing item 11 in the context of this proposed rule. 

Stakeholder Outreach

Because of the Commission's direction in SRM-SECY-07-0148 to strongly encourage public 

comments to ensure all stakeholders' views are considered during the rulemaking process, the 

Office of Nuclear Security and Incident Response (NSIR) requests that the Office of Federal 

and State Materials and Environmental Management Programs (FSME) post draft versions of 

the proposed rule text to the Federal e-Rulemaking Website at www.regulations.gov to obtain 

stakeholder input during the development of the proposed rule. Additionally, NSIR staff posted 

 

3 See Federal Register on March 19, 2007 (72 FR 12705), under response to public comment Issue 5 

(at 72 FR 12716): "... the NRC is currently considering future rulemakings to align the generally-licensed [ISFSI] and 

specifically-licensed ISFSI requirements and to evaluate the application of the DBT [for radiological sabotage]."

4

 The C-10 Research and Education Foundation, Inc. submitted petition for rulemaking (PRM-72-6) to the NRC on 

November 24, 2008. The NRC noticed receipt of PRM-72-6 and requested public comments in the Federal Register

on March 3, 2009 (74 FR 91718).
6

a draft of this technical basis to the Federal e-Rulemaking Website for public comment under 

Docket ID NRC-2009-0558. 

B Background 

The NRC requires high assurance of adequate protection of public health and safety, the 

common defense and security, and the environment for the secure storage of spent nuclear fuel 

(SNF) and high-level radioactive waste (HLW). The NRC meets this strategic goal by requiring 

licensees to comply with security requirements specified in Title 10 of the Code of Federal 

Regulations, Part 73 (10 CFR Part 73), “Physical Protection of Plants and Materials.” Following 

the terrorist attacks of September 11, 2001, the NRC has achieved this requisite high 

assurance for all independent spent fuel storage installations (ISFSIs) (i.e., facilities that are 

licensed to store SNF) through a combination of existing security regulations in 10 CFR Part 73 

and the issuance of security orders to existing individual licensees. These orders ensured that 

a consistent overall protective strategy is in place for all types of ISFSIs, given the current threat 

environment. The issuance of these orders was noticed in the Federal Register (FR).5

 

Subsequent to the issuance of these orders to existing ISFSI licensee, the NRC issued security 

orders to all new ISFSI licensees, before such facilities began operation. These subsequent 

orders were also noticed in the FR.6

 The NRC has not issued any licenses for an MRS, nor are 

any applications for a license for an MRS pending before the NRC. The Commission's most 

recent comprehensive reviews of ISFSI security regulations occurred in conjunction with 

rulemakings in 1994 and 1998.7 8

 The NRC notes that ISFSIs were considered during this 1994 

rulemaking; however, the Commission ultimately concluded that land vehicle bomb protection 

requirements were not necessary for ISFSIs at that time. 

The current security regulations for ISFSIs are quite complex and pose challenges both to NRC 

staff and to the regulated industry. This regulatory complexity is due to multiple factors, 

including: two different types of ISFSI licenses (general and specific licenses) under 10 CFR 

Part 72, “Licensing Requirements for the Independent Storage of Spent Nuclear Fuel, HighLevel Radioactive Waste, and Reactor-Related Greater Than Class C Waste,” and varying 

applicability of regulations based upon whether the ISFSI is collocated with an operating power 

reactor, is collocated with a decommissioning power reactor, or is located away from any power 

reactors.9

In recognition of these various challenges, the NRC staff presented policy paper SECY-07-

0148, dated August 28, 2007, to the Commission which summarized the current regulatory 

structure for ISFSI security, analyzed several policy and process issues, and provided 

recommendations in order to obtain early Commission direction on the development of an ISFSI 

security rulemaking. A redacted version of policy paper SECY-07-0148 is publicly available 

(see NRC Agencywide Documents Access and Management Systems (ADAMS) Accession 

 

5 See Federal Register on October 23, 2002 (67 FR 65150 and 67 FR 65152). 6 For example, see Federal Register on August 25, 2004 (69 FR 52314). 7 Final rule - 10 CFR Part 73, "Protection Against Malevolent Use of Vehicles at Nuclear Power Plants." Published in 

the Federal Register on August 1, 1994 (59 FR 38889). 8 Final rule - 10 CFR Parts 60, 72, 73, 74 and 75, "Physical Protection for Spent Nuclear Fuel and High Level 

Radioactive Waste." Published in the Federal Register on May 15, 1998 (63 FR 26955).

9 For the purposes of this technical basis, the term "collocated, specific licensee" represents a specific-license ISFSI 

that is collocated at a power reactor facility which has an NRC license to operate. The term "non-collocated, specific 

licensee" will include both a specific-license ISFSI that is collocated with a power reactor with a possession-only 

license and a specific-license ISFSI located away from any power reactors. This nomenclature is reflected in Figure1 

below.
7

Number ML080030050) under the NRC’s Electronic Reading Room (see 

http://www.nrc.gov/reading-rm.html). Subsequently, the Commission, in a Staff Requirements 

Memorandum (SRM-SECY-07-0148), dated December 18, 2007, (see ADAMS Accession 

Number ML073530119), directed the NRC staff to accomplish a proposed security rulemaking 

for the storage of SNF and to develop supporting regulatory guidance documents. The 

Commission’s SRM also directed the staff to strongly encourage public comments to ensure all 

stakeholders’ views are considered during the rulemaking process, especially with regard to 

potential licensing, emergency preparedness, and security plan impacts. As stated previously, 

this rulemaking is in response to the Commission’s direction. 

Current ISFSI Security Regulatory Structure 

In addition to storing SNF in spent fuel pools under a reactor facility’s license, spent fuel can 

also be safely and securely stored in facilities licensed independent of a reactor site using both 

wet and dry storage systems. Under the licensing regulations in 10 CFR Part 72, there are two 

types of ISFSI licenses (i.e., general and specific) that are available for the storage of spent 

fuel. Physical security requirements are located in various sections in 10 CFR Part 73 

depending on the type of licensee. Additionally, the regulations in 10 CFR 72.212(b)(5), require 

general licensees to establish a physical protection program that protects the spent fuel against 

the design-basis threat (DBT) for radiological sabotage (10 CFR 73.1) in accordance with the 

regulations for power reactor security under 10 CFR 73.55. For general-license ISFSIs, neither 

10 CFR 72.212(b)(5) nor 10 CFR 73.55 impose a dose limit for security events (i.e., acts of 

radiological sabotage). However, certain specific-license ISFSIs are required to meet the dose 

limits of 10 CFR 72.106 which specifies a 0.05-Sievert (Sv)(5-rem) dose limit for security-related 

events, resulting in a loss of control of the facility.10

The staff has developed Figure 1 below as an aid in describing the complexity and applicability 

of the current ISFSI licensing and security regulations under 10 CFR Parts 72 and 73, 

respectively. 

 

10 The dose criteria in 10 CFR 72.106 includes separate limits of 0.05 Sv (5 Rem) total effective dose equivalent; 

0.15 Sv (15 Rem) to the lens of the eye; and 0.5 Sv (50 Rem) as either the sum of the deep dose equivalent and any 

organ dose, or the shallow dose equivalent to the skin or any extremity. Collectively, these values are referred to as 

the 0.05-Sv (5-Rem) dose limit.
8

Figure 1. Current NRC Security Regulations for ISFSIs 

Based on their applicability provisions, the regulations in 10 CFR 72.180, 10 CFR 72.182, and 

10 CFR 73.51 currently apply to all specific-license ISFSIs without any exceptions. However, 

past staff practice has permitted collocated, specific licensees to develop their ISFSI's security 

plans in accordance with the more stringent requirements of 10 CFR 73.55.11 Additionally, the 

statements of consideration accompanying a Part 72 final rule clarifying the applicability of the 

various provisions of Part 72 to general licensees, specific licensees, and certificate holders 

indicated that specific licensees collocated at an operating 10 CFR Part 50 power reactor facility 

are excluded from the provisions of 10 CFR 73.51. 

Therefore, the staff has only subjected non-collocated, specific licensees to the requirements 

of 10 CFR 72.180, which states such licensees must establish, maintain, and implement a 

detailed plan for physical protection as described in 10 CFR 73.51. The regulations 

in 10 CFR 73.51 require non-collocated, specific licensees to have a physical protection system 

that is designed such that a loss of control of the facility (e.g., from a terrorist attack) would not 

result in a radiation exposure exceeding a 0.05-Sv (5-rem) dose limit at the controlled area 

boundary (i.e., the safety dose limits of 10 CFR 72.106). Unlike the regulations 

in 10 CFR 72.212(b)(5), neither 10 CFR 72.182 nor 10 CFR 73.51 includes specific language 

 

11 For the purposes of this technical basis, the term "collocated, specific licensee" represents a specific-license ISFSI 

that is collocated at a power reactor facility which has an NRC license to operate. The term "non-collocated, specific 

licensee" will include both a specific-license ISFSI that is collocated with a power reactor with a possession-only 

license and a specific-license ISFSI located away from any power reactors. This nomenclature is reflected in 

Figure 1 above.
9

requiring a specific ISFSI licensee to protect the spent fuel or high-level radioactive waste 

against the DBT for radiological sabotage. 

In fact, 10 CFR 73.1 lists exceptions to certain DBT requirements for various classes of 

licensees. Specific-license ISFSIs had previously been identified as being exempted from 

certain provisions of the DBT rule, but were removed in the March 2007 final rule. This was 

because 10 CFR 72.182 did not contain specific language requiring protection of the spent fuel 

(in a specific-license ISFSI) against the DBT for radiological sabotage (i.e., the intent of the rule 

was for 10 CFR 73.1 to remain consistent with 10 CFR 72.182). Consequently, the NRC’s 

current regulations do not specify whether collocated, specific-license ISFSIs are required to 

protect against the DBT for radiological sabotage, in contrast to the clear requirements of 

10 CFR 72.212(b)(5) for general-license ISFSIs to protect the spent fuel against the DBT for 

radiological sabotage. 

Based on their applicability provisions, 10 CFR 72.180, "Physical Protection Plan," and 

10 CFR 73.51, "Requirements for the Physical Protection of Stored Spent Nuclear Fuel and 

High-level Radioactive Waste," apply to all specific-license ISFSIs without any options. 

However, past staff practice has permitted collocated, specific licensees to develop their ISFSI's 

security plans based upon on the requirements of 10 CFR 73.55.12 Additionally, the statements 

of consideration accompanying a Part 72 final rule clarifying the applicability of the various 

provisions of Part 72 to general licensees, specific licensees, and certificate holders indicated 

that specific licensees collocated at an operating 10 CFR Part 50 ("Domestic Licensing of 

Production and Utilization Facilities") power reactor facility are excluded from the provisions of 

10 CFR 73.51.13 Therefore, in practice, the staff has only subjected non-collocated, specific 

licensees to the requirements of 10 CFR 72.180, which states such licensees must establish, 

maintain, and implement a detailed plan for physical protection as described in 10 CFR 73.51. 

Even though both general and collocated, specific licensees are required to comply with 

selected provisions of 10 CFR 73.55, the final power reactor security rule revising this 

regulation did not address security requirements for collocated, specific-license ISFSIs, but the 

Commission chose to defer this issue to a separate future rulemaking.14 

Finally, the NRC notes that conservatisms may exist in the modeling of the quantity of 

radiological material that might be released from an attack against spent fuel in a storage cask. 

Subsequent to any possible future studies, we acknowledge the possibility of differences in 

potential scenarios. 

Impacts of Using a Denial Protective Strategy

Under a dose-based acceptance criteria, some ISFSI or MRS licensees might have to revise 

their current protective strategy from a "detect, assess, and communicate" protective strategy to 

a "denial of task" protective strategy due to site-specific limitations (e.g., limited room to expand 

the distance between their ISFSI or MRS and their controlled area boundary). Consequently, if 

a constrained licensee cannot meet the dose limit through the use of passive security measures 

(e.g., the use of engineered security features or through changes to the ISFSI's design), one of 

 

12 Letter to Mr. James P. O’Hanlon, “Request for Exemption from 10 CFR 73.51(d)(3) Requirements, North Anna 

Independent Spent Fuel Storage Installation (ISFSI) and Surry ISFSI (TAC Nos. L22707 and L22708)," ADAMS No. 

ML060320261, dated November 12, 1998.

13 Final Rule - 10 CFR Part 72, "Clarification and Addition of Flexibility.” Published in the Federal Register on 

August 21, 2000 (65 FR 50606). See public comment Issue A.1 (at 65 FR 50608).

14 Final rule - 10 CFR Parts 50, 52, 72, and 73, "Power Reactor Security Requirements." Published in the Federal 

Register on March 27, 2009 (74 FR 13925).
10

the options available to the licensee would be to use active security measures (e.g., a "denial" 

protective strategy) to prevent a successful terrorist attack. The NRC envisions that only very 

few licensees may be sufficiently constrained to be unable to meet the radiological dose 

criterion through the use of passive security measures and thus would be compelled to shift to a 

"denial of task" protective strategy. Moreover, the NRC anticipates continuing the current 

practice of not performing force-on-force (FOF) exercises against ISFSI licensees implementing 

a "detect, assess, and communicate" protective strategy. However, if an ISFSI licensee revises 

its security program to employ a "denial of task" protective strategy, then the NRC staff would 

reevaluate the need for a FOF exercise against that ISFSI on a case-by-case basis. 

The use of a "denial of task" protective strategy raises issues of sufficient technical complexity 

to necessitate prior staff review and approval of a licensee's security plan. The NRC bases this 

conclusion on: (1) experience gained by NRC staff in the 2003 - 2004 reviews of changes to 

reactor security plans to implement the security and DBT orders and the resultant degree of 

complexity and the need for interactions with licensees; and (2) a desire to maintain an 

appropriate independence and separation of NRC security plan review and approval and 

inspection functions. For a specific-license ISFSI, NRC prior review and approval of applicant's 

initial security plans is required under the current regulations. Under 10 CFR 72.44(e), "License 

Conditions," licensees may make certain changes to their security plan without NRC prior 

review and approval, if such changes do not decrease the effectiveness of the security plan. 

For a general-license ISFSI, the security requirements for the ISFSI are incorporated in the 

security plan (required under Part 50) for the associated power reactor license and are subject 

to inspection by NRC regional staff, not to staff prior review and approval. Similarly, reactor 

licensees are permitted under 10 CFR 50.54(p)(1), "Conditions of Licenses," to make certain 

changes to their security plan without prior NRC review and approval, provided such changes 

do not decrease the effectiveness of their security plan. In all likelihood, a general-license 

ISFSI's shift to a denial protective strategy would not decrease the effectiveness of the 

associated power reactor's security plan under 10 CFR 50.54(p)(1). However, as discussed 

earlier and notwithstanding the provisions of 10 CFR 50.54(p)(1), the staff would revise the 

regulations to require a reactor licensee, associated with a general-license ISFSI who chooses 

to employ a "denial of task" protective strategy for the ISFSI, to submit its security plan (for 

protecting both the reactor and ISFSI) to the NRC for prior review and approval. A licensees 

submittal of a security plan for a site implementing a “denial” protective strategy for the NRC’s 

review and approval, would be a specific licensing action under the associated Part 50 license 

that would create a potential hearing right under section 189 of the AEA.15

The staff notes that some Part 50 licensees who are currently using the Part 72 general license 

process have required amendments to their Part 50 license to accommodate the presence of 

the ISFSI, thus creating a potential hearing right under the Part 50 license. An example of this 

was for heavy loads issues (e.g., the use of single failure proof cranes and revised heavy load 

pathways). Therefore, revising the necessary regulations to require a general-license ISFSI, 

who was compelled to adopt a "denial of task" protective strategy, to submit the site (reactor 

and ISFSI) security plan to the NRC for review and approval would be consistent with the 

current Part 50 reactor license/Part 72 general-license ISFSI regulations. Consequently, the 

 

15 The current 10 CFR Part 72 general license regulations implement provisions of Sections 133 and 218(a) of the 

Nuclear Waste Policy Act of 1982, as amended (42 U.S.C. 10153 and 10198, respectively). Section 218(a) 

mandated that the Commission by rule approve technologies for the dry storage of spent fuel at civilian nuclear 

power reactors, "without to the extent practicable," the need for additional site specific (i.e., licensing) approvals by 

the Commission. Under the NRC’s current Part 72 general license regulations, no site-specific licensing actions are 

required to store spent nuclear fuel under the general license (10 CFR 72.210) contained in Part 72, Subpart K, for 

the cask designs approved under 10 CFR 72.214). 
11

staff's view is that the potential for hearing requests would be essentially the same as it is under 

the current regulations. 

Petition for Rulemaking (PRM-72-6), Item 11 – Hardened On-Site Storage

On November 24, 2008, the C-10 Research and Education Foundation, Inc., submitted a 

petition for rulemaking to the NRC that requested changes to both the safety requirements 

found in 10 CFR Part 72 and the security requirements found in 10 CFR Part 73, that apply to 

the dry storage of spent nuclear fuel. The NRC docketed this petition for rulemaking as Docket 

No. PRM-72-6. The NRC issued a notice of receipt and request for comments on this petition in 

the Federal Register (74 FR 9178) on March 3, 2009. A copy of the petition and any public 

comments submitted in response to this notice can be found at the Federal e-Rulemaking 

Website at http://www.regulations.gov under Docket ID [NRC-2008-0649]. As discussed above, 

the issues raised by the petitioner in item 11 of PRM-72-6 are relevant to this proposed 

rulemaking. 

C. Background on Why the Current Regulation Needs to be Revised 

The existing security requirements in 10 CFR Part 73 for waste storage facilities licensed to 

possess SNF and HLW have been in place without change, in many cases, since the late 

1980’s and the 1990’s. As new applications for ISFSIs were received and new cask designs for 

general licensed ISFSIs were approved, differing approaches were requested by the applicants 

and approved by the NRC. As a result, the existing ISFSI security regulatory structure in 

10 CFR Part 73 is complex, difficult for the NRC staff, licensees, and the public to understand 

and apply, and does not meet the NRC’s objective of regulatory clarity. This proposed 

rulemaking seeks to remove the existing complexities and to clarify ISFSI and MRS security 

regulations and institute a risk-informed and performance-based structure to these regulations 

that would be consistent for all ISFSI and MRS facilities. 

This proposed rulemaking also seeks to update these regulations to make generically 

applicable requirements similar to those previously imposed by the security orders issued by 

the NRC to ISFSI licensees following the terrorist attacks of September 11, 2001. Additionally, 

the NRC’s post -9/11 security assessment of several types to spent fuel storage systems 

indicated that improvements to the security requirements for such facilities were appropriate. 

These assessments challenged previous NRC conclusions on the ability of a malevolent act to 

breach shielding and/or confinement barriers and thus release radiation or radioactive material; 

and indicated that increased security requirements were warranted. 

Finally, this proposed rule seeks to eliminate the disparate application of the DBT for 

radiological sabotage to ISFSI and MRS facilities under the current regulations by not applying 

the DBT for radiological sabotage to such facilities, but instead applying a risk-informed and 

performance-based approach with a specific dose acceptance standard. 

D. Role of This Rulemaking in Terms of the NRC Strategic Plan 

This proposed rulemaking supports the NRC Strategic Goal of Security and strategic objectives 

of openness and effectiveness. The Strategic Goal of Security is intended to provide high 

assurance that licensees will protect public health and safety, the common defense and 

security, and the environment from malevolent acts against the SNF and HLW stored in these 

facilities; and thus ensure the secure use and management of radioactive materials. The 
12

strategic outcome for the Strategic Goal of Security is to prevent any instances in which NRClicensed materials are used domestically in a manner hostile to the United States. 

To support the NRC’s objectives of openness and effectiveness the NRC staff has continued to 

actively inform stakeholders and the public of the agency’s proposed actions in this rulemaking 

and sought informed comment during the agency’s rulemaking process. In support of this 

objective, the NRC staff has made a number of presentations on these concepts to the public, 

licensees, and other stakeholders. These presentations have included the 2009 Waste 

Management Conference in Phoenix, AZ on March 3, 2009 (see ADAMS Accession No. 

ML090060183); the 2009 Nuclear Energy Institute Dry Storage Forum in Bonita Springs, FL on 

May 12, 2009 (see ADAMS Accession No. ML092310526); and the 2009 ISFSI Security 

Conference in Stone Mountain, GA on October 15, 2009 (see ADAMS Accession No. 

ML092820591). Additionally, on June 30, 2009, the staff held a Webinar to provide the public, 

licensees, and other stakeholders technical and policy information on this proposed rulemaking 

(see ADAMS Accession No. ML092310560). 

In addition, the NRC staff posted a draft of this revised technical basis on the Federal 

e-Rulemaking Website at http://www.regulations.gov under Docket ID NRC-2009-0558 on 

December xx, 2009, to obtain public, licensee, and other stakeholder comments and input. The 

NRC staff also published a notice of availability of this draft technical basis in the Federal 

Register (74 FR xxxxx) on December xx, 2009. Finally, the NRC staff held a Webinar on 

January 14, 2010, to facilitate the submission of informed comments and questions on this 

technical basis from the public, licensees, certificate holders, and other stakeholders. 

Overall, yy organizations or members of the public participated in the Webinar [list types of 

stakeholders]. The NRC received xx comments on this technical basis. A summary of the 

comments received on the draft technical basis was also posted on the Federal e-Rulemaking 

Portal under Docket ID NRC-2009-0558 (see also ADAMS Accession No. ML10dddxxxx). 

E. Scope of this Rulemaking 

The overall scope of this rulemaking would include revising existing regulations in 10 CFR 

Part 72 and Part 73, and adding new regulations in 10 CFR Part 73. This would include the 

following regulations – 

• In 10 CFR 72.180, the NRC would update this requirement to use a cross reference to the 

new ISFSI security requirements for ISFSIs and MRSs established by this rule in Part 73. 

• In 10 CFR 72.182, the NRC would update the requirements to reflect the performance 

objectives for the ISFSI and MRS security rulemaking (see objectives above). 

• In 10 CFR 72.212(b)(5), the NRC would remove specific security requirements for general 

license ISFSIs from this regulation and instead use a cross reference to the new ISFSI 

security requirements for ISFSIs established by this rule in Part 73. 

• In 10 CFR 73.1(a), the NRC would remove language that subjects a general license ISFSI 

to the DBT for radiological sabotage. 

• In 10 CFR 73.51, the NRC would remove language applying this regulation to ISFSIs or 

MRSs. 

• In 10 CFR 73.400, 73.405, etc., the NRC would add a new series of regulations that would 

provide the security requirements for all types of ISFSIs and MRSs. This would consist of a 

performance objective and overview section and specific requirements sections that would 

apply to specific types of facilities. These specific requirements sections would address the 
13

different types of ISFSIs (e.g., collocated dry-storage ISFSIs, away-from-reactor dry-storage 

ISFSIs, and pool ISFSIs) and the application of different protective strategies (for these 

different types of facilities). MRSs would be grouped with away from reactor ISFSIs. 

This rulemaking would not include any revisions to the security requirements in the current 

10 CFR 73.51 that apply to a geologic repository operations area (GROA) (i.e., a geologic 

repository facility licensed by the NRC to dispose of SNF and HLW under 10 CFR Parts 60 or 

63). 

F. Access Authorization and Fingerprinting 

Requirements for fingerprinting and background investigations to allow unescorted access to 

ISFSIs and MRSs would be addressed in this proposed rulemaking. However, the technical 

basis for these requirements has already been submitted to FSME in a separate memo from 

Richard P. Correia to Dennis K. Rathbun, dated September 30, 2008 (see ADAMS Package 

No. ML082270355). Although that memo did not specifically include MRSs, the technical bases 

applied to ISFSIs in this area should be applied to MRSs as well. The NRC has issued security 

orders imposing Access Authorization requirements on ISFSI licensees since August 18, 2004. 

The NRC has also issued security orders imposing fingerprinting requirements on ISFSI 

licensees since February 23, 2007. These previous requirements should be reflected in the 

regulatory analysis supporting the proposed rule. 

G. General Security Requirements 

The proposed requirements specified in this technical basis would establish the objectives and 

minimum security performance standards that would be located under 10 CFR Part 73 that 

licensees, who are authorized to store SNF and HLW under the provisions of 10 CFR Part 72, 

must meet in order to provide high assurance that the storage of such SNF and HLW does not 

pose an unacceptable risk to public health and safety, the common defense and security, and 

the environment. These proposed requirements would apply to any facility authorized to store 

SNF or HLW under the provisions 10 CFR Part 72, and would apply to all such current and 

future licensees. 

As an overall objective, licensees would be required to meet the following security performance 

capabilities: 

(1) Evaluate the potential radiological consequences due to the release of radiation 

or radioactive material from the applicable security scenarios (that are specified 

by the NRC) using site specific information (input parameters). Calculate the 

potential dose that could be received by an individual located between the facility 

and the ISFSI’s or MRS’ site boundary. Verify that the dose received by an 

individual on or beyond the ISFSI’s or MRS’ controlled area boundary would not 

exceed the 0.05-Sv (5-Rem) dose limit; and 

(2) If the potential dose would exceed the 0.05-Sv (5-Rem) dose limit, then the 

licensee would be required to establish and implement security measures to 

meet this dose limit or to modify the input parameters in this evaluation in order 

to meet this dose limit. Otherwise the licensee would be required to identify and 

implement changes to their security program, to the design or operation of the 

ISFSI or MRS, to the licensee’s protective strategy, or to employ natural or 
14

engineered security features that would either prevent to prevent the applicable 

security scenario(s) from causing a release of radiation or radioactive material. 

(3) Evaluate the effects from the detonation of a land-based or waterborne vehicle 

bomb attack (the size of the explosive and the vehicle characteristics are 

specified by the NRC) against the storage casks, facility, or pool; against the 

central and secondary alarm stations; against security personnel defensive 

positions (if the licensee employs a denial strategy); and against a transfer 

container if the transfer pathway is not protected by a temporary or permanent 

vehicle barrier system. 

(4) Design, install, and implement a vehicle barrier system (VBS) to mitigate the 

effects of a land-based or waterborne vehicle bomb attack. The design of the 

VBS may use natural landform obstacles. A separate analysis for any potential 

waterborne vehicle bomb vulnerability would not be required for facilities where 

the land-based evaluation envelops the entire SNF or HLW storage facility. The 

design of engineered VBS components would be required to meet an 

international consensus technical standard for VBS hardware under ASTM 

Standard F2656-07 for the applicable vehicle characteristics specified by the 

NRC.16 Further detailed information is provided in a later VBS paragraph. 

(5) Design, install, and implement the equipment, personnel, procedures, and 

policies of the physical security program (e.g., alarm stations, protected area 

barriers, detection and assessment, training, contingency response, etc.) 

Existing licensees would be required to revise and update their Physical Security Plans (PSPs) 

to reflect any necessary changes to their physical protection system or protective strategy in 

order to meet these security performance objectives. Licensees who choose to implement a 

denial protective strategy would be required to submit their security plans to the NRC for prior 

review and approval. These submittals would be via a license amendment or via a license 

application, as applicable. 

 

H. Specific Security Requirements: Specific Security Points of Consideration 

The proposed regulations defining the physical protection systems for SNF or HLW storage 

facilities would require a multi-faceted approach. Licensees would be required to analyze their 

facility (1) against certain security scenarios and verify any potential dose releases are within 

regulatory limits, and (2) against specific adversary characteristics (e.g., a land-based or 

waterborne vehicle bomb assault) and to implement a vehicle barrier system to protect the SNF, 

HLW, and critical security functions. In an effort to continue to protect against potential 

adversaries that are multi-facetted in their approach, technically savvy, and ever adapting to 

defensive methodologies, the licensees would be required to evaluate their security program 

against security performance (adversary) characteristics that are specified by the NRC. 

Licensees would also be required to establish security hardware systems (e.g., central alarm 

stations, intrusion detection and monitoring systems, protected area barriers, communication 

systems, and search and assessment systems) to best address these potential malevolent acts. 

Licensees would be further required to establish security personnel systems (e.g., controls over 

access to protected areas and Safeguards Information, fitness for duty programs, and insider 

 

16 ASTM Standard F2656, 2007, “Standard Test Method for Vehicle Crash Testing of Perimeter Barriers,” 

ASTM International, West Conshocken, PA, 2007, DOI 10.1520/F2656-07, www.astm.org. 
15

mitigation programs) and to plan and coordinate with offsite local law enforcement agency 

(LLEA) personnel for LLEA responses to security emergencies. Licensees would be required to 

establish training and qualification programs for security personnel and contingency response 

programs that are integrated into the licensee’s emergency preparedness program. 

The proposed regulations would be structured in a manner that addresses significant 

operational differences between these similar types of facilities (e.g., ISFSIs that are located at 

reactors, located inside a reactor’s protected area, or are located away from any reactors and 

MRSs), yet achieves consistent security outcomes across this class of licensees. However, 

differences in some requirements and the NRC’s review of the PSPs may be created for 

licensees implementing a “detect, assess, and communicate” protective strategy, versus those 

implementing a “denial” strategy. The regulations would also allow for flexibility in where the 

licensee documents these PSPs. For example, an ISFSI that is collocated at a reactor site 

could incorporate the ISFSI’s PSPs within an appendix of the reactor’s PSP, or the ISFSI PSPs 

could exist as stand alone documents). In either case, the content of the plans would be the 

same. 

The proposed regulations would build upon the current ISFSI security regulations, the NRC 

staff’s accumulation of lessons learned from the last two decades of security inspections, FOF 

exercises, and review of implementation of security orders; and the NRC’s recent final rule 

revising the power reactor security requirements (74 FR 13926; March 27, 2009). These 

‘Lessons Learned’ do not reside in an integrated staff document. Rather, these are shared 

issues and concerns raised by NRC staff during the course of inspections, FOF evaluations, 

and security plan licensing reviews over the last decade. Except where specifically highlighted 

as a new requirement, it is the NRC’s intent to update existing requirements to provide more 

clarity and detail for the security functional areas. The proposed regulations then, would 

address the following security performance capabilities and functions: 

(1) Vulnerability Driven Physical Protection Program 

In an effort to conform to a risk-informed and performance-based structure, all 

references to applying the DBT for radiological sabotage against an ISFSI or 

MRS (i.e., a threat-based approach) would be removed from regulations in 

10 CFR Parts 72 and 73. The basis for this is discussed above. Instead, 

licensees would be required to use information provided by the NRC from ISFSI 

and MRS security performance (adversary) characteristics and ISFSI and MRS 

security scenarios to assess vulnerabilities and to develop physical security 

programs that prevent and mitigate these vulnerabilities in order to achieve 

acceptable outcomes. Licensees would not be required to evaluate against 

aircraft impacts. This is a new requirement that did not previously exist in the 

NRC’s regulations or security orders for ISFSIs and MRSs. 

(2) Physical Security Plan 

The licensee would be required to develop, establish, and maintain a PSP for the 

facility that describes how the security protective strategy will be implemented. 

The PSP would be required to provide for the integration of security activities, 

including the response to security emergencies, amongst security, operations, 

radiation protection, and emergency preparedness personnel. The PSP would 

describe the functions, composition, and roles and responsibilities for security 

personnel, security hardware and barriers, and security analyses in 
16

implementing the licensee’s protective strategy. The licensee’s PSP would 

address the controls for keys, locks, combinations, and computer systems. 

ISFSIs collocated with a power reactor, would have the option to integrate the 

ISFSI’s PSP into the reactor’s PSP (e.g., as an appendix to the reactor’s PSP). 

Alternatively, the licensee could develop a standalone PSP for the ISFSI. The 

licensee would also be able to integrate ISFSI security activities and functions 

with the reactor security activities and functions, as it desired. However, any 

integration of ISFSI and reactor security activities and functions would not be 

permitted to have an adverse effect on the security of the reactor (see Item 25 

below). While this has been informally allowed in the past, this specific flexibility 

would be added as a new regulation. 

 

For licensees implementing a “detect, assess and communicate” protective 

strategy, the PSP would be required to describe the licensee’s arrangements, 

including any associated agreements with their nearby LLEA, explaining the 

response capabilities and timing, including the numbers of responding LLEA 

personnel. All existing ISFSI licensees implement a voluntary “detect, assess, 

and communicate” protective strategy. The PSP would also be required to 

describe the licensee’s roles and responsibilities during LLEA-led take-back and 

recovery operation. This is a new requirement that did not previously exist in the 

NRC’s regulations or security orders for ISFSIs and MRSs. 

For licensees who based upon their analysis and dose calculations choose to 

use a “denial” protective strategy, such licensees would be required to submit 

their PSPs to the NRC for prior review and approval. These PSPs would be 

submitted as part of a license application or a license amendment, irrespective of 

whether the licensee was using the general or specific license provisions of 

10 CFR Part 72. Specific licensees would submit these PSPs as an amendment 

under the provision of 10 CFR 72.56. General licensees would submit these 

PSPs as an amendment to the collocated reactor’s license under the provisions 

of 10 CFR 50.90, “Application for amendment of license, construction permit, or 

early site permit.” In this context, the PSPs would include the training and 

qualification plan, and the contingency response plan. This is a new requirement 

that did not previously exist in the NRC’s regulations or security orders for ISFSIs 

and MRSs. 

Based upon the NRC staff’s recent experience in completing comprehensive 

reviews of the security plans for power reactor facilities, the NRC views the 

complexity of a denial-based PSP, along with the likely need to request 

additional information, as necessitating an evaluation by the agency’s technical 

security experts in the NRC’s Office of Nuclear Security and Incident Response. 

Consequently, to accomplish such an evaluation requires that a license submit 

their PSPs to the NRC for prior review and approval. 

The NRC’s regulations on using a general license to store SNF at an ISFSI do 

not currently require any site-specific licensing approvals by the NRC. However, 

under Section 218(a) of the Nuclear Waste Policy Act of 1982 (NWPA), as 

amended, (42 U.S.C. 10198), Congress directed the Commission to implement 

by rule the use of dry storage technologies “without, to the maximum extent 

practicable, the need for additional site-specific approvals by the Commission” 

(i.e., licensing actions and hearings). Consequently, Section 218(a) of the 
17

NWPA does not prohibit all site-specific licensing actions under the ISFSI 

general license process. Therefore, the NRC views the prior review and 

approval of PSPs (which would be considered a site-specific licensing action) as 

necessary, appropriate, and consistent with the NWPA for the PSPs’ of an ISFSI 

or a MRS facility that chooses to implement a denial-based protective strategy. 

(3) Training and Qualification Plan 

The licensee would be required to develop, establish, and maintain a training 

and qualification plan for the security forces that describes how the criteria set 

forth in Appendix B to 10 CFR Part 73 are maintained and trained to. These 

plans would include routine performance evaluation to validate these measures. 

These specific areas for evaluation include: assessing and responding to threats, 

insider mitigation, rules for use of deadly force, weapons training, maintenance 

of qualifications, and support of LLEA response and recovery activities. Further 

information on the training of security personnel on the use of deadly force is 

provided below. This is a requirement under the current regulations for ISFSIs 

and MRSs. 

(4) Contingency Response Plan 

The licensee would be required to develop, establish, and maintain a security 

contingency response plan that describes how the security forces would 

implement the licensee’s protective strategy in response to off-normal, abnormal, 

and emergency security events. The plan would address LLEA interactions and 

licensee roles and responsibilities in supporting LLEA response and recovery 

activities. This is a requirement under the current regulations for ISFSIs and 

MRSs. 

(5) Access Authorization Program 

The licensee would be required to develop, establish, and maintain an access 

authorization program, including fingerprinting, for access to the protected area 

of an ISFSI or MRS, or to access to Safeguards Information for these facilities. 

The purpose scope and implementation of the access authorization program 

would be described in the PSP or addressed in a stand alone document. 

Processes for the removal, reinstatement, and revalidation of those individuals 

granted unescorted access to the ISFSI would be developed and included in the 

program. This plan would address visitors and procedures for escort and access 

screening. This is a new requirement that did not previously exist in the NRC’s 

regulations for ISFSIs and MRSs, but was imposed by security orders for ISFSIs. 

(6) Insider Mitigation Program 

The licensee would be required to develop, establish, and maintain an insider 

mitigation program as part of its access authorization program and physical 

security program. The insider mitigation program would be required to address 

passive insiders, active insiders, and active-violent insiders and access to 

physical security systems and spaces as well as cyber systems that are 

important to the safety or the security of the ISFSI or MRS facility. This is a new 
18

requirement that did not previously exist in the NRC’s regulations or security 

orders for ISFSIs and MRSs. 

(7) Vehicle Barrier Systems 

The licensee would be required to complete a blast analysis for land-based and 

waterborne vehicle bombs. The licensee would be required to deploy a 

permanent Vehicle Barrier System (VBS) for an ISFSI or MRS facility. The 

licensee would be required to analyze their facility against both a land-based 

vehicle bomb assault and any applicable waterborne vehicle bomb assault. The 

design of the VBS may use natural landform obstacles. A separate analysis for 

any potential waterborne vulnerability would not be required for facilities where 

the land-based evaluation envelops the entire facility. The NRC will specify the 

bomb and vehicle characteristics used in these analyses. The establishment of 

a VBS is intended to be an integral part of the overall facility’s physical protective 

system. This is a new requirement that did not previously exist in the NRC’s 

regulations for ISFSIs and MRSs, but was imposed by security orders for ISFSIs. 

The VBS may use engineered components and landform obstacles to achieve 

the necessary standoff distance to mitigate any blast or shrapnel effects for 

necessary components of the facility. The VBS is intended to provide sufficient 

standoff distance, in any situation, no less than 35 feet, to mitigate against blast 

and shrapnel effects for the SNF and/or HLW facility and storage containers, the 

primary and secondary alarm stations, armed response personnel defensive 

positions (for licensee’s implementing a denial protective strategy), and any other 

equipment necessary for the safety and security of the ISFSI or MRS facility. 

For collocated ISFSI facilities where the ISFSI is located outside the reactor 

facility’s Protected Area (PA) (i.e., the ISFSI is in a separate PA), the licensee’s 

blast analysis and VBS, including the use of landform obstacles, would also be 

required to encompass the pathway used for transferring SNF from the reactor 

facility to the ISFSI storage area. However, the VBS would not require the use of 

permanent components (i.e., temporary barriers could be used). For away from 

reactor ISFSIs or an MRS, the receiving facility and the storage area would be 

required to be located with a PA that protected by an appropriate VBS or 

landform obstacles. 

VBS systems would be required to permit the passage of authorized personnel, 

equipment, and vehicles into the ISFSI or MRS and could use remotely operated 

or manual mechanisms to permit the passage of equipment and vehicles into the 

ISFSI or MRS. Licensees would be required to meet an international consensus 

technical standard for VBS hardware under ASTM Standard F2656-07 for the 

bomb and vehicle characteristics specified by the NRC. This is a new 

requirement that did not previously exist in the NRC’s regulations or security 

orders for ISFSIs and MRSs. 

(8) Physical Barrier Systems 

The licensee would be required to develop, establish, and maintain two physical 

barriers for their facility, including the design, use, and construction of any 

normal and alternate personnel and equipment access points. One barrier would 
19

be the Protected Area (PA) barrier. The second barrier would consist of the 

cask, storage vault, or storage pool walls. The descriptions of the first (i.e., PA) 

physical barriers would continue to address components, such as barrier fencing, 

isolation zones, intrusion detection systems, assessment and monitoring 

systems, bullet resisting barriers for occupied personnel areas, illumination 

requirements for assessment and observation, or the use of night capable 

observation systems that would meet the specific requirements equivalent to the 

Commission’s recent final rule in10 CFR 73.55(c)(5). Licensees may use visible 

or non-visible spectrum (e.g. infra-red) illumination systems provided that the 

guards possess the necessary equipment to assess the facility remotely and 

locally in response to alarms. The PA barrier systems are integrated with the 

detection and assessment systems and would also be required to provide for 

access and inspection portals for both personnel and equipment. For the second 

barrier, the licensee would describe the nature and composition of the second 

barrier. Note, this second barrier is not the VBS system mentioned in item 7 

above. This is a requirement under the current regulations for ISFSIs and 

MRSs. 

 

 (9) Intrusion detection systems 

The licensee would be required to develop, establish, and maintain intrusion 

detection systems (IDS) as part of its PA barrier. These systems would also be 

required to be supervisory alarmed and tamper indicating. The licensee’s plans 

would describe the necessary calibration and testing requirements that are 

necessary to achieve the required sensitivity in detecting intrusions. The 

description would also include interfaces with the alarms stations, assessment 

and monitoring systems, and video capture systems. This is a requirement 

under the current regulations for ISFSIs and MRSs. 

(10) Video Capture 

The licensee would be required to monitor the isolation zones of the PA barrier 

with intrusion detection equipment that is capable of detecting both attempted 

and actual penetration of the PA perimeter. The licensee would be required to 

use assessment equipment (for monitoring the PA isolation zones) that is 

capable of providing real-time and play-back/recorded video images of the 

detection activities before and after each isolation zone alarm annunciation. This 

is a new requirement that did not previously exist in the NRC’s regulations or 

security orders for ISFSIs and MRSs. 

(11) Access Points and Search Equipment 

The licensee would be required to develop, establish, and maintain process and 

procedures for searching personnel, equipment, and vehicles that enter a PA for 

contraband, firearms, ammunition, and explosives. This would include the use of 

explosive and metal detectors. The licensee would be required to describe the 

methodology, items to be searched for, training requirements, personnel involved 

in search, search equipment capabilities and requirements, and remote 

monitoring of search areas and activities by video surveillance. The licensee 

would also be able to use physical searches, in lieu of detection equipment, if 

individuals had been previously searched, for example an ISFSI that is located 
20

separate from a reactor facility could rely upon security systems for entry into the 

reactor protected area to accomplish the initial search of an individual. This is a 

requirement under the current regulations for ISFSIs and MRSs. 

(12) Alarm Station Capabilities 

The licensee would be required to develop, establish, and maintain alarm 

stations for security personnel to monitor the facility; assess normal, 

off-normal, and emergency security events; communicate with security 

personnel, LLEA contacts, and other components of a collocated facility’s 

personnel (e.g., operations, maintenance, and emergency response 

organizations); and exercise command and control over security personnel in 

any response to security events. The licensee would be required to have two 

alarm stations that are redundant and independent and not susceptible to singlenode failures. The licensee would continue to be required to have a central 

alarm station (CAS) and a secondary alarm station (SAS). The CAS would be 

required to be located at the facility and would be required to be located with in a 

protected area with bullet resisting barriers. However, the CAS would not be 

required to be located inside the SNF or HLW storage areas (i.e., the CAS would 

not be required to be located within a radiation area). The SAS would be 

permitted to be remotely located from the facility and could monitor more than 

one SNF and HLW storage facility. This is a requirement under the current 

regulations for ISFSIs and MRSs. 

(13) Redundant Communications Equipment Capabilities 

The licensee would be required to develop, establish, and maintain 

communications for the Security Force that would provide a redundant means of 

communication between security personnel, the CAS and/or SAS, as well as 

between the CAS and the SAS. Acceptable communication methods between 

sources could consider cellular phones, land line phones, hand held and fixed 

station radio systems, as well as any real time communications system available 

and utilized by the licensee. The licensee’s system would be required take into 

account any onsite and offsite power and communication resources to ensure 

effective command and control during normal, abnormal, and emergency events. 

This is a requirement under the current regulations for ISFSIs and MRSs. 

(14) Independent Power Systems 

Under this new requirement, the licensee would be required to establish, and 

maintain independent power sources in the event of the loss of normal power. 

Examples of security systems for consideration include non-portable 

communications, alarm systems, and any emergency response equipment 

deemed necessary through appropriate analysis by the licensee. This provision 

would be similar to language recently approved by the Commission in the final 

power reactor security rule under 10 CFR 73.55(i)(5). This is a new requirement 

that did not previously exist in the NRC’s regulations or security orders for ISFSIs 

and MRSs. 
21

(15) Single Node Failures 

The licensee would be required to ensure the operability of those systems 

necessary for the security of the facility are not disrupted by the destruction of, or 

damage to, a single node by either a security threat or natural phenomena. 

Licensees would use a performance-based approach to achieve redundant and 

diverse systems that are not subject to single-node failures. Security engineered 

design features may also be used to protect a single-node vulnerability to 

achieve this objective. This is a new requirement that did not previously exist in 

the NRC’s regulations or security orders for ISFSIs and MRSs. 

(16) Force-on-Force Security Evaluations 

The NRC staff is not proposing that the Commission consider any class of SNF 

or HLW storage facility licensed under 10 CFR Part 72 as appropriate, for 

conducting NRC evaluated force on force exercises. 

In evaluating the nature of the risks from SNF and HLW storage facilities, the 

nature and mechanism of the potential releases of radioactive material from acts 

of sabotage against an ISFSI or MRS, the potential responses from security 

personnel to such acts, and the costs and risks of such exercises, the NRC does 

not see sufficient value in conducting NRC-evaluated FOF exercises for ISFSI 

and MRS facilities to outweigh the potential costs and safety risks associated 

with FOF exercises. 

However, the proposed rule would require licensees implementing a denial 

protective strategy, as part of their quality assurance program, to conduct their 

own performance evaluations for their security personnel protecting an ISFSI or 

MRS. This would be similar to that recently approved by the Commission for 

power reactors under Section VI.C.3 of Appendix B to Part 73. For ISFSIs 

located at a reactor facility, such licensee FOF evaluations of the ISFSI facility 

may be integrated with the licensee FOF evaluations of the reactor facility’s 

security performance. This is a new requirement that did not previously exist in 

the NRC’s regulations or security orders for ISFSIs and MRSs. 

(17) Deadly Force Training 

The licensee would be required to develop, establish, and maintain training for 

armed security personnel on applicable State restrictions on the use of force, up 

to and including the use of deadly force. Such training would be part of a 

licensee’s training and qualification plan for armed security personnel. 

Licensees would also be required to retrain armed security personnel on such 

restrictions annually. Licensees collocated at a reactor site would be able to 

integrate armed ISFSI security personnel’s training with armed reactor security 

personnel’s training, in lieu of establishing a separate program. This is a 

requirement under the current regulations for ISFSIs and MRSs. 

(18) Suspension of Security Measures 

Licensees would be permitted to suspend certain security measures during 

exigent or emergency situations, e.g., suspend roving patrols during hazardous 
22

situations, such as flooding, hurricanes, or tornados. This provision would be 

similar to language recently approved by the Commission in the final power 

reactor security rule under 10 CFR 73.55(p). This is a new requirement that did 

not previously exist in the NRC’s regulations or security orders for ISFSIs and 

MRSs. 

(19) Alternative Measures 

Licensees would be permitted to propose alternative security measures to the 

NRC from those established by these proposed regulations, provided these 

alternative measures meet the same performance objectives and requirements 

specified in these proposed regulations. This provision would be similar to 

language recently approved by the Commission in the final power reactor 

security rule under 10 CFR 73.55(r). This is a new requirement that did not 

previously exist in the NRC’s regulations or security orders for ISFSIs and MRSs. 

(20) Records 

Licensees would be required to maintain records of security activities and make 

them available to the Commission for inspection, copy, and removal. This 

provision would be similar to language recently approved by the Commission in 

the final power reactor security rule under 10 CFR 73.55(q). This is a new 

requirement that did not previously exist in the NRC’s regulations or security 

orders for ISFSIs and MRSs. 

 

(21) Compensatory Measures 

Licensees would be required to identify criteria and measures to compensate for 

degraded or inoperable equipment, systems, and components that are 

necessary to meet these proposed requirements. This provision would be 

similar to language recently approved by the Commission in the final power 

reactor security rule under 10 CFR 73.55(o). This is a new requirement that did 

not previously exist in the NRC’s regulations or security orders for ISFSIs and 

MRSs. 

(22) Maintenance, Testing, and Calibration 

Licensees would be required to establish, maintain, and implement a 

maintenance, testing and calibration program to ensure that security systems 

and equipment are tested for operability and performance at predetermined 

intervals, maintained in operable condition, and are capable of performing their 

intended functions. This provision would be similar to language recently 

approved by the Commission in the final power reactor security rule under 

10 CFR 73.55(n). This is a new requirement that did not previously exist in the 

NRC’s regulations or security orders for ISFSIs and MRSs. 

(23) Security Program Reviews 

Licensees would be required to periodically review each element of their security 

program. This provision would be similar to language recently approved by the 

Commission in the final power reactor security rule under 10 CFR 73.55(m). 
23

This is a new requirement that did not previously exist in the NRC’s regulations 

or security orders for ISFSIs and MRSs. 

(24) Key Facility Security and Emergency Response Information 

Licensees would be required to provide descriptive information on their facility 

that would be used by the NRC to rapidly evaluate the potential impacts upon 

SNF and HLW storage facilities resulting from rapid changes to the threat 

environment. The NRC intends to integrate this information into a database that 

would be available to decision makers in the NRC’s Headquarters Operations 

Center and to Headquarters and Regional security staff. This would include: 

Distance from the storage facility to the controlled area boundary; 

Distance from the storage facility to the site boundary; 

Facility location (latitude and longitude); 

Type of facility (pool, dry vault, horizontal or vertical dry storage casks, etc.); 

For dry storage casks, the number and type of casks used; and 

The protective strategy used. 

. 

Existing licensees would provide this information to the NRC within 90 days of 

the effective date of a final rule. New licensees would provide this information to 

the NRC at the time of commencement of initial operation of their facility. All 

licensees would provide updated information annually to the NRC (by January 15 

of each year) to address the previous calendar year or to indicate no changes 

from their previous submittal. 

Currently this information is sent to the NRC piecemeal manner, or is available 

onsite in licensee records. The NRC recognizes that the submission of this 

information is a new reporting burden; however, the NRC’s initial estimate of 20 

staff hours per licensee per year is not considered a significant impact. This is a 

new requirement that did not previously exist in the NRC’s regulations or security 

orders for ISFSIs and MRSs. 

 (25) Armed Security Officers and Armed Responders 

Licensees would be required to determine the number of armed security officers 

necessary to implement the protective strategy that is necessary to defend 

against the security scenarios and security performance (adversary) 

characteristics specified by the NRC. The minimum number of armed security 

officers would be specified in the licensee’s security plans. Of these armed 

security officers, a minimum of two individuals must be available to assess 

conditions at the ISFSI or MRS and evaluate alarms (in order for the licensee to 

accomplish a “detect, assess, and communicate” protective strategy); and to 

provide access control at a collocated ISFSI that does not have a dedicated 

access control facility. For an ISFSI collocated with a power reactor, these two 

individuals may not also serve as armed responders for the power reactor 

facility’s security plan (i.e., security personnel may not be double counted 

(credited as able to respond) in physically separated facilities). 
24

Licensees implementing a “denial” protective strategy would also be required to 

determine the number of armed responders necessary to implement the 

protective strategy that is necessary to defend against the security scenarios and 

security performance (adversary) characteristics specified by the NRC to 

interdict and neutralize the NRC specified adversaries. The minimum number of 

armed responders would be specified in the licensee’s security plans. This 

provision would be similar to language recently approved by the Commission in 

the final power reactor security rule under 10 CFR 73.55(k). These are new 

requirements that did not previously exist in the NRC’s regulations for ISFSIs 

and MRSs. 

(26) Effective Date and Compliance Date 

The NRC would propose that a final rule on these ISFSI and MRS regulations 

take effect 30 days after its publication in the Federal Register. However, 

existing licensees would have one (1) year from the effective date of the final rule 

to complete required analyses, design and develop necessary solutions, and, if 

necessary, submit any revised security plans to the NRC. Licensees would then 

have six (6) additional months for implementation and to achieve full compliance 

with the final rule. 

The NRC recognizes that implementing these new provisions is not simple and 

would provide this time to allow for licensees to complete required engineering 

analyses; procure and install any new security equipment; revise security, 

operations, and maintenance procedures; and train affected personnel. 

Licensees who choose to implement a denial strategy would be required to 

submit their plans and analyses to the NRC for prior review and approval within 

one year, to achieve timely submission objectives. Licensees would continue 

under their current security plans until NRC approval is received and they would 

be deemed to be in compliance with these requirements.