NEI 05-10 [Revision 3] 

Security Frequently

Asked Questions Process

July 2012 
[THIS PAGE IS LEFT BLANK INTENTIONALLY]
Nuclear Energy Institute, 1776 I Street N. W., Suite 400, Washington D.C. (202.739.8000) 

NEI 05-10 [Revision 3] 

Nuclear Energy Institute 

Security Frequently

Asked Questions Process 

July 2012 
UACKNOWLEDGMENTS 

NEI wishes to acknowledge the efforts of the NEI Security Frequently Asked Questions Task 

Force members as well as industry and U.S. Nuclear Regulatory Commission contributors 

involved in developing this document. 

UNOTICE

Neither NEI, nor any of its employees, members, supporting organizations, contractors, or 

consultants make any warranty, expressed or implied, or assume any legal responsibility for the 

accuracy or completeness of, or assume any liability for damages resulting from any use of, any 

information apparatus, methods, or process disclosed in this report or that such may not 

infringe privately owned rights. 
NEI 05-10 (Revision 3) 

July 2012 

i 

U

UTABLE OF CONTENTS 

1 0BINTRODUCTION .......................................................................................................... 1

2 1BSFAQ CRITERIA ......................................................................................................... 2

3 MAKEUP OF SECURITY QUESTION PANELS ............................................................. 3

4 REGULATORY PROCESS INTERFACE ........................................................................ 4

5 SFAQ DOCUMENTATION AND SAFEGUARDS CONSIDERATIONS ............................. 5

6 SFAQ LOG AND STATUS TRACKING .......................................................................... 6

7 APPROVAL AND APPEALS ........................................................................................ 7

8 WITHDRAWAL, TRANSMITTAL, AND MODIFICATION ................................................ 8

9 SFAQ IMPLEMENTATION ........................................................................................... 9

10 PROCESS OUTLINE .................................................................................................. 10

11 PROCESS FLOWCHART ........................................................................................... 12

12 SFAQ FORM ............................................................................................................. 13
NEI 05-10 (Revision 3) 

July 2012 

ii 

[THIS PAGE IS LEFT BLANK INTENTIONALLY]
NEI 05-10 (Revision 3) 

July 2012 

1

SECURITY FREQUENTLY ASKED QUESTIONS PROCESS 

1 0BINTRODUCTION 

The purpose of the Security Frequently Asked Questions (SFAQ) Process is to provide an 

organized forum for licensees and the NRC to resolve generic questions concerning the 

implementation of security requirements in a collaborative and coordinated context. This 

process is intended to support the resolution of licensees’ questions in a timely and effective 

manner and support the NRC’s exercising of its regulatory responsibility in the most 

efficient and direct manner possible. 

The SFAQ process cannot be used to change any regulatory requirements promulgated 

through rules or orders. The intent of this process is to clarify existing guidance and to 

assist in addressing implementation questions related to security programs under 10 CFR 

Part 73. 
NEI 05-10 (Revision 3) 

July 2012 

2

2 1BSFAQ CRITERIA 

For a question to be considered under the SFAQ process, the question must be generic (i.e., 

have the potential to affect more than one plant without consideration or evaluation of site 

specific information). Potential SFAQs include questions where licensees or the NRC 

believe there would be a benefit for providing additional clarification of a requirement. In 

order to determine whether a question should be considered under the SFAQ process, the 

initiating panel (industry or NRC) shall apply the following criteria: 

 The question must be sufficiently generic. (Does it affect more than one plant without 

consideration or evaluation of site specific information?) 

 The question does not involve unresolved inspection issues, enforcement actions, 

allegations, or other situations covered by existing regulatory processes. The SFAQ 

process may be used to disseminate information regarding resolved inspection issues, 

enforcement actions, allegations, or other situations covered by existing regulatory 

processes. 

 The resolution of the question should facilitate consistent implementation of industry or 

NRC security guidance. 

If all the criteria are met, then a question may be appropriate for resolution utilizing the 

SFAQ process. 

 In those cases where it is not clear that a question meets all of the above criteria, the 

initiating panel should include the question in the SFAQ process for independent 

screening by each panel (industry and NRC). 
NEI 05-10 (Revision 3) 

July 2012 

3

3 MAKEUP OF SECURITY QUESTION PANELS 

The Industry Panel will consist of representatives from the commercial nuclear power 

industry and at least one NEI representative. The Industry Panel members shall consist of 

management personnel experienced in security matters and represent the commercial 

nuclear industry. 

NEI senior management shall designate an NEI representative who will function as the 

Industry Panel Chair. The Industry Panel Chair will also arrange meetings and provide 

administrative support for the communication and transmittal of SFAQ status and 

resolution. 

The licensee originating an SFAQ may be invited to provide a representative to present and 

describe the SFAQ at the meetings where the SFAQ is discussed. 

NRC management will designate a corresponding review panel (hereafter referred to as the 

NRC Panel) and the NRC Panel Chairman. 
NEI 05-10 (Revision 3) 

July 2012 

4

4 REGULATORY PROCESS INTERFACE 

The SFAQ process is intended to provide clear answers to generic questions that could 

affect industry implementation of security requirements. Frequently, generic questions are 

identified through the NRC Inspection and Enforcement process. It is important that the 

respective roles of each process be maintained. For the specific licensee(s) for which 

unresolved inspection issues or violations are involved, the inspection and enforcement 

process (including the licensee’s option to appeal the NRC’s decision) will take precedence 

and should proceed independently of the resolution of any related SFAQ. The SFAQ 

process must focus on a generic question and avoid site-specific factors that might distort 

the understanding of the resolution. 
NEI 05-10 (Revision 3) 

July 2012 

5

5 SFAQ DOCUMENTATION AND SAFEGUARDS CONSIDERATIONS 

Many of the questions dealing with nuclear power plant security may involve Safeguards 

Information (SGI). Any person allowed access to SFAQs containing SGI must have an 

established “need to know” for the information and meet the requirements of 10 CFR 73.21. 

Any SGI material associated with the SFAQ must be stored, transmitted and distributed in 

accordance with the requirements of 10 CFR 73.21 and other applicable NRC requirements. 

Non-SGI questions and related material will be handled in accordance with NRC Regulatory 

Issue Summary 2005-26, “Control Of Sensitive Unclassified Non-Safeguards Information 

Related To Nuclear Power Reactors,” and with 10 CFR 2.390 – ”Public Inspections, 

Exemptions, Requests for Withholding,” as applicable. 
NEI 05-10 (Revision 3) 

July 2012 

6

6 SFAQ LOG AND STATUS TRACKING 

In order to facilitate efficient tracking, review, and closure of SFAQs, the Industry Panel 

Chair will maintain a non-Safeguards log of all SFAQs (SGI and non-SGI). SFAQs 

generated by the NRC Panel will be provided to the Industry Panel Chairman to be logged 

and tracked. The non-SGI log will show basic information such as unique tracking number, 

date initiated, initiator, and current status. This log will be available to each Panel and 

updated on a periodic basis. 

Both Panel Chairs will maintain a file of in-process and completed SFAQs. 
NEI 05-10 (Revision 3) 

July 2012 

7

7 APPROVAL AND APPEALS 

Separately, each panel will meet and examine the questions (SFAQs) that have been 

accepted for consideration, developing a response that is documented on the form. Then, 

the two panels will meet, on an as needed base. The objective of the meeting is to share 

and/or present each panel’s views of SFAQs submitted. When the panels agree on an 

SFAQ, it is provided to the NRC Deputy Director – Division of Security Policy (DSP) for 

final approval. Where the panels do not agree, each panel may submit alternative answers 

and comments regarding other options under consideration with written rationale for final 

approval. This information shall be provided to the NRC Director - DSP with copies 

provided to both panels. Upon reaching a decision between alternate proposed SFAQ 

responses, the NRC Director - DSP will provide a response back to both panels setting forth 

the rationale for the chosen option. 

If the industry disagrees with the decision of the NRC-Director-DSP, the industry has the 

right to appeal the decision as outlined in Section 10, Step 5. 
NEI 05-10 (Revision 3) 

July 2012 

8

8 WITHDRAWAL, TRANSMITTAL, AND MODIFICATION 

An SFAQ may be withdrawn by the initiating Panel at any time prior to final disposition. 

Once an SFAQ response/solution has been approved by NRC it is distributed by NEI and 

the NRC using approved means. In addition, the NEI representative will update the SFAQ 

Log. 

In the event that any approved SFAQ resolution is subsequently determined to require 

revision, the revised SFAQ must be reprocessed. 
NEI 05-10 (Revision 3) 

July 2012 

9

9 SFAQ IMPLEMENTATION 

SFAQs that involve changes to the NEI 03-12 template language should be revised 

immediately through the licensee’s security plans if required to demonstrate compliance 

with NRC regulations. SFAQs that affect the site specific information provided as 

bracketed text within NEI 03-12 should be changed through the licensee’s security plans as 

necessary. Utilities should make any necessary changes to their Security Plan (PSP), 

Training and Qualification Plan (T&Q), Contingency Plan (SCP), and Cyber Security Plan 

(CSP) consistent with the implementation date agreed upon by the industry and NRC. The 

NRC will be notified of the changes in accordance with the requirements of 10 CFR 

50.54(p). 

The following statement should be considered in the accepted SFAQs that affect NEI 03-12 

black text: “Licensees submitting their security plans using the NRC endorsed NEI 03-12 

revision [#] template should revise the endorsed text in section [...] of the [PSP, T&Q, SCP 

as appropriate] by [provide direction on text to be revised, replaced, inserted, and when it 

should be revised]”. 

The change to the NRC endorsed NEI 03-12 revision [#] language should be listed on the 

“Table of Deviations from NEI 03-12 revision [#] Text” which has been provided by NEI to 

accompany each plan submittal. The justification that should be provided on the table is 

“Language revised in accordance with SFAQ # [##-##]”. 
NEI 05-10 (Revision 3) 

July 2012 

10

10 PROCESS OUTLINE 

In addition to the following SFAQ process description, a flow chart of this process is 

provided as Attachment 1. 

Identification and Question Development (Step 1) 

Industry or NRC personnel will send potential SFAQs arising from internal reviews, 

industry operating experience, NRC inspections, or other sources, to the Industry Panel 

Chair. Use of the SFAQ form (Attachment 2) is encouraged. The proposed SFAQ should 

provide appropriate references from regulatory or industry documents. The history, 

operating conditions and description of security features may be relevant and should be 

included as supporting documentation. The submittal should include a proposed answer 

where possible. The NRC will establish a similar process governed by their internal 

procedures. Initiators should check the SFAQ log to prevent redundancy with existing 

questions. It is imperative that facts and supporting documentation are complete and 

accurate in all material respects. 

Panel Screening (Step 2) 

Both panels separately shall conduct an initial screening of proposed SFAQs to determine 

whether they meet the criteria of Section 2. In the event that a question does not meet those 

criteria, or where it duplicates questions addressed in existing SFAQs or other questions 

undergoing screening, the appropriate Panel Chair shall notify the originator that the 

question will not be resolved through the SFAQ process. For cases which are screened as 

meeting criteria for an SFAQ, a brief description shall be provided to the Industry Panel 

Chairman who shall assign an SFAQ number and enter it in the SFAQ Log. 

Internally Develop a Proposed Response (Step 3) 

Once a question is accepted by each panel as an SFAQ, an individual from the initiating 

Panel will be assigned to further develop the proposed final response if necessary. This will 

include consideration of proposals by the initiator. The proposed final response should be 

internally discussed within the initiating Panel. After this internal consideration, the SFAQ, 

including the proposed final response will be submitted via the appropriate Panel Chair to 

the counterpart Panel. This effort should be done two weeks prior to the meeting unless the 

frequency of meetings requires compression of that interval. 

Panel Interaction and Review (Step 4) 

The Panel(s) will meet periodically to discuss SFAQs. Items for the agenda will be agreed 

upon by the Panel Chairs and should include as many pending SFAQs as can be 

accommodated. 

New SFAQs on the agenda should be presented by the initiating Panel. While the draft 

should already have been distributed, this presentation provides an opportunity to ask 
NEI 05-10 (Revision 3) 

July 2012 

11

clarifying questions. Candid exchange is encouraged to facilitate consideration of all 

pertinent aspects by all parties. 

In cases involving a question that is in need of prompt resolution, the Panel(s) may 

accelerate the processing of the SFAQ. This must be identified to both Chairs sufficiently in 

advance to permit appropriate internal review. 

After internal review subsequent to this initial presentation, written revisions or alternative 

resolutions should be developed with rationale provided. These should be provided to both 

panels via their Chairs at least one week in advance of the subsequent Joint Panel meeting. 

At the second meeting regarding a specific SFAQ, the Panel(s) should present the proposed 

final resolution(s). If mutual understanding is not reached, both Panels should attain 

outstanding points of agreement and disagreement in order to modify or clarify their panel’s 

proposed resolution for subsequent review. One or both panels should agree to take action 

to provide a revised proposed final resolution at the next meeting. 

Appeal (if necessary) (Step 5) 

If the panels do not agree at the second meeting, each panel shall send its proposed 

resolution of the SFAQ to the NRC Director - DSP for a decision. Each panel (industry and 

NRC) has the opportunity to comment on the others proposed resolution before presentation 

to the Director. 

After the decision by the NRC Director - DSP a copy of the approved SFAQ response shall 

be returned to the Panel(s). The Panels separately will review the SFAQ response to check 

that its content is consistent with their understanding of the SFAQ’s final resolution. 

The industry, as represented by the NEI Chief Nuclear Officer, may appeal decisions of the 

Director - DSP to NRC management (Director of the Office of Nuclear Security and 

Incident Response) within one month. The decision of the Director of the Office of Nuclear 

Security and Incident Response is the NRC’s final resolution and position of the SFAQ. 

The NRC should attempt to resolve the industry’s appeal within one month of its receipt. 

The SFAQ will not be issued until the appeal has been resolved. 

Dissemination (Step 6) 

Once an SFAQ response/solution has been approved by the NRC, it is distributed by NEI 

using approved means. In addition, the NEI representative will update the SFAQ Log. 

SFAQ responses can be effective immediately. If implementation timing guidance is 

appropriate, those should be arranged between the Panel Chairs and communicated 

concurrently with dissemination of the SFAQ answer. Prior to issuance, the proposed 

solution text of the SFAQ worksheet will be deleted to assure a clear understanding of the 

final response. 
NEI 05-10 (Revision 3) 

July 2012 

12

11 PROCESS FLOWCHART 
NEI 05-10 (Revision 3) 

July 2012 

EXEMPT FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 

§2.390 

EXEMPT FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 

§2.390 

13

12 SFAQ FORM 

SFAQ YY-XX Title 

Security Frequently Asked Questions (SFAQ) Request Form 

SFAQ Number: _________ (Industry Panel Chair to Complete)

(Requestor to Complete) 

Licensee: Date Submitted: 

Licensee Contact: Phone: E-mail: 

NRC Contact: Phone: E-mail: 

Potentially Relevant Existing SFAQ Numbers: 

This Question Involves: 

(Check All That Apply) 

Design Basis , Force-on-Force , Training , 

Access , Security Plan , Cyber , Other : 

Question, Including Background Description and Applicable Reference(s): 

Proposed Solution: 

 

Additional Pages Attached: Yes No 

(NEI to Complete) 

Request #: Date Entered: By: 

 
NEI 05-10 (Revision 3) 

July 2012 

EXEMPT FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 

§2.390

EXEMPT FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 

§2.390 

14

SFAQ Evaluation and Resolution Section 

SFAQ Number: _________ (Industry Panel Chair to Complete)

Resolution of SFAQ

 

(NRC Security Question Panel Chairman) 

Approved By: Date: 

(Industry Security Question Panel Chairman) 

Approved By: Date: 

SFAQ Closed in Tracking System and SFAQ Database Updated: Date: 

Form Revision 3, 07/12 

Issue Presented at Joint NRC/NEI Security Question Panel on: 

Resolution Requires a Document(s) Revision: Yes No Document(s):