________________

POLICY ISSUE

(Information) 

January 8, 2015 SECY-15-0003

FOR: The Commissioners 

FROM: Mark A. Satorius 

Executive Director for Operations 

SUBJECT: STAFF ACTIVITIES RELATED TO COUNTERFEIT, FRAUDULENT, AND 

SUSPECT ITEMS 

PURPOSE: 

This paper informs the Commission of the staff’s activities regarding counterfeit, fraudulent, and 

suspect items (CFSI) as they relate to U.S. Nuclear Regulatory Commission (NRC) regulated 

activities. This paper does not address any new commitments or resource implications. This 

paper is the final planned status update on the topic. 

SUMMARY: 

In SECY-11-0154, “An Agencywide Approach to Counterfeit, Fraudulent, and Suspect Items 

(CFSI),” dated October 28, 2011, (Agencywide Documents Access and Management System 

(ADAMS) Accession No. ML112200150), the staff informed the Commission of activities to 

assess and enhance processes for addressing CFSI in NRC-regulated activities. As part of 

efforts directed by a steering committee composed of senior agency managers, the staff 

reviewed agency activities related to CFSI; domestic and international operating experience; 

and implementation of the action items from SECY-11-0154. Based on this review, it was 

apparent that existing agency processes have been effective in addressing CFSI. This review 

also reinforced the importance of open intra-agency communications in addressing complex 

challenges. Completion of the actions described in SECY-11-0154 serves to strengthen agency 

processes and stakeholder awareness of the challenges presented by CFSI. 

CONTACT: Daniel J. Pasquale, NRO/DCIP 

 301-415-2498
The Commissioners 2 

Licensees and industry organizations have also focused on the challenges presented by CFSI. 

In a joint effort with the Nuclear Energy Institute (NEI), the Electric Power Research Institute 

(EPRI) developed a guidance document for use by licensees to aid in preventing the 

introduction of CFSI into nuclear facilities. The EPRI guidance was finalized in July 2014 and 

provides the necessary fundamental elements for detecting and preventing CFSI from affecting 

NRC-regulated activities. 

BACKGROUND: 

Beginning in 2009, the staff noted increasing CFSI activity in the industrial (non-nuclear) supply 

chain. The NRC’s Office of the Inspector General (OIG) issued an audit report on September 

28, 2010, OIG-10-A-20, “Audit of NRC’s Vendor Inspection Program,” (ADAMS Accession No. 

ML102710583) that referenced many of the same non-nuclear CFSI events that the NRC staff 

were also monitoring. The OIG audit report recommended that the staff develop a formal 

agencywide strategy to monitor CFSI. 

In response to the OIG recommendation, the staff formed an internal task force composed of 

representatives from NRC offices that could potentially be affected by counterfeit, fraudulent, 

and suspect items issues. After engaging other Federal agencies, industry organizations, and 

public stakeholders, the staff developed 19 actions to assess and enhance processes to 

address counterfeit, fraudulent, and suspect items. The staff presented these actions in 

SECY-11-0154, which includes information about the staff’s use of working groups to identify 

and assess current practices, evaluate potential vulnerabilities, and develop planned actions. 

DISCUSSION: 

The discussion below provides the status of each of the 19 planned actions from 

SECY-11-0154. Of these 19 planned actions, 14 have been completed and the remainder will 

be completed by December 2018. 

• The staff will establish periodic meetings with stakeholders, including industry 

representatives, for the purpose of communicating each party’s progress and direction, 

sharing best practices, and understanding and assisting with any identified barriers to 

success. 

To date, the NRC staff has facilitated seven public meetings in support of actions to address 

CFSI. These meetings have been well attended by a wide range of participants, including 

representatives of NEI, the Institute of Nuclear Power Operations, EPRI, NRC licensees, the 

Construction Industry Institute, Federal agencies, international nuclear regulatory agencies, and 

members of the general public. The NRC Regulatory Information Conferences in 2013 and 

2014; and the biennial NRC-sponsored vendor workshops in 2010, 2012, and 2014 all included 

CFSI sessions. Based on these interactions, the staff determined that future stakeholder 

meetings will be conducted on an as-needed basis. 

Additionally, the staff will incorporate CFSI information into the NRC public web site. The new 

web site will serve as an information portal that includes reference documents and status 

updates on NRC activities related to CFSI. 
The Commissioners 3 

• The staff will issue generic communications to share industry efforts to address CFSI. 

Since 2011, the staff has issued three generic communications related to CFSI. Information 

Notice 2012-22, “Counterfeit, Fraudulent, Suspect Items (CFSI) Training Offerings,” informs 

addressees of some entities that offer training on how to detect potential CFSI that may enter the 

supply chain. The staff issued Information Notice 2013-02, “Issues Potentially Affecting Nuclear 

Facility Fire Safety,” to draw attention to reports of counterfeit fire protection equipment issued 

by the U.S. Defense Logistics Agency Headquarters and Underwriters Laboratories, Inc. It 

should be noted that the NRC has not identified any issues at licensed facilities involving 

counterfeit equipment or cable fire-testing certification. In Information Notice 2013-15, “Willful 

Misconduct/Record Falsification and Nuclear Safety Culture,” the staff describes a vendor’s 

criminal actions to destroy serial numbers in an attempt to conceal a component’s origin before 

it was installed in a U.S. nuclear plant. 

The staff will continue to use the generic communications process as one of the avenues to 

communicate information in the future. As an example, the staff plans to issue a Regulatory 

Issue Summary (ADAMS Accession No. ML14192B407) by February 2015 to communicate how 

existing NRC regulations relate to CFSI. 

• The staff will coordinate with the effort to clarify 10 CFR Part 21, “Reporting of Defects and 

Noncompliance,” to specifically define CFSI in guidance as a deviation that requires 

evaluation under 10 CFR Part 21 and a condition adverse to quality under Criterion XVI, 

“Corrective Action,” of Appendix B to 10 CFR Part 50. 

The NRC staff has provided CFSI input into developing the regulatory basis to clarify Title 10 of 

the Code of Federal Regulations (10 CFR) Part 21, “Reporting of Defects and Noncompliance.” 

In December 2012, the agency published draft Revision 0 of the regulatory basis (ADAMS 

Accession No. ML12248A200). It should be noted that 10 CFR Part 21 was not intended to be 

a reporting mechanism for counterfeit and fraudulent items unless they could create a 

substantial safety hazard. Further action will be addressed by the rulemaking process. 

• The staff will continue with cyber security program development activities, to include 

verification and assessment of appropriate system and service acquisition security controls 

as required by the cyber security plan. The NRC has approved implementation schedules 

for each site as required by the cyber security rule, 10 CFR 73.54, “Protection of Digital 

Computer and Communication Systems and Networks.” 

The staff has inspected interim implementation of cyber security programs at more than half of 

power reactor sites. Full cyber security program implementation inspections, which will be 

completed over a 3-year period (expected to begin in 2015) will verify and assess 

implementation of appropriate system and service acquisition security controls, as the cyber 

security plan requires. 

• The staff will continue with development of guidance for vendor inspection of safety-related 

critical digital assets (CDAs). The licensees have committed to implement system and 

service acquisition security controls in their cyber security plans. The NRC will inspect the 

implementation of these controls in accordance with 10 CFR 73.54(f). 
The Commissioners 4 

The staff revised NRC Inspection Procedure 43002, “Routine Inspections of Nuclear Vendors,” 

to provide additional guidance to inspectors for verifying cyber security requirements included in 

a purchase order, and assessing the actual techniques used to verify acceptability of contractual 

cyber security requirements passed down from a licensee or applicant to a supplier. 

• The staff will continue to issue generic communications or otherwise notify the industry of 

cyber or other clandestine threats to CDA supply chains that the NRC identifies through the 

operating and construction experience programs or through research conducted by the staff. 

There are processes in place to collaboratively evaluate threat information with NRC program 

offices and issue generic communications to notify the industry. The Office of Nuclear Security 

and Incident Response will issue security advisories for security-related issues or information 

assessment team advisories for threats that warrant a generic communication. 

• The staff will incorporate CFSI information from appropriate sources (domestic and 

international) and related industry organizations that could apply to U.S. commercial nuclear 

facilities into the current NRC operating experience and construction experience programs. 

The staff has revised procedures to add a specific screening element for CFSI into the 

Operating Experience/Construction Experience Center of Expertise (COE). In addition, the staff 

has used the quality assurance, vendor issues, and CFSI technical review group to review 

CFSI-related items provided by the COE. The CFSI component of this technical review group 

will be established as a stand-alone group, which will review CFSI events that are provided by 

the COE. 

• The staff will continue to promote information sharing through interagency outreach efforts 

with appropriate Federal agencies (e.g., U.S. Government Inter-Agency Anti-Counterfeiting 

Working Group, Department of Defense, Department of Energy, Department of Homeland 

Security, National Aeronautics and Space Administration, Department of Justice, etc.). 

Affected directives and implementing procedures will be revised as necessary. 

The staff has conducted outreach activities with numerous Federal agencies to share best 

practices and lessons learned. The staff has promoted information sharing with the Department 

of Energy, Department of Commerce, Department of Defense, Department of Justice, Federal 

Aviation Administration, Federal Energy Regulatory Commission, the Government Industry Data 

Exchange Program, and the Department of Homeland Security’s National Intellectual Property 

Rights Coordination Center. Through these outreach activities, the staff has not yet identified a 

need to revise any NRC directives or procedures; however, the staff intends to maintain this 

interagency network in order to continue sharing information and to stay informed about CFSI 

programs at other Federal agencies. 

The staff has also engaged the international community on CFSI, specifically the Organization 

for Economic Cooperation and Development’s Nuclear Energy Agency (NEA) and the United 

Nation’s International Atomic Energy Agency. Outreach to these organizations has focused on 

regulatory approaches for identifying and sharing best practices and lessons learned on CFSI. 

As part of its activities in the NEA’s Committee on Nuclear Regulatory Activities (CNRA), the 

staff recommended that CNRA explore the potential to improve multilateral sharing of 

information related to CFSI incidents. The staff has also initiated the development of a nonlegally binding International Protocol for responding to identified CFSI with the National Nuclear 
The Commissioners 5 

Safety and Security Commission of the Republic of Korea. The staff anticipates inviting other 

regulatory counterparts such as Canada, Mexico, Japan, the United Kingdom, France, the 

United Arab Emirates, and Spain to join this Protocol in the future. Currently, staff is utilizing an 

internal Office Instruction for sharing CFSI events with regulatory counterparts. 

• The staff will continue to communicate with stakeholders via the NRC’s existing generic 

communications program about any potential CFSI training or applicable informational 

sources that could increase awareness of CFSI. 

The staff issued Information Notice 2012-22, “Counterfeit, Fraudulent, Suspect Items (CFSI) 

Training Offerings,” to inform addressees of some entities that offer training on how to detect 

potential CFSI that may enter the supply chain. The staff will continue to use the generic 

communications process to share information in the future. 

• The staff will emphasize through the NRC’s allegations training module that the (NRC)

allegation process should be used when a licensee, a supplier, or an NRC staff member 

identifies CFSI. 

The NRC requires that all NRC employees complete an annual allegation training course. The 

staff has revised the course to include a module on CFSI awareness and sensitivity. The new 

module introduces possible scenarios NRC employees could encounter while executing their 

duties and responsibilities. These training scenarios are intended to heighten awareness to 

potential indicators of CFSI. 

 

• The staff will develop training for NRC inspectors to assist them in assessing the 

effectiveness of programs and processes of licensees and suppliers of basic components to 

identify and prevent CFSI. 

Members of the vendor inspection staff conducted training during each NRC region’s inspector 

counterpart meeting to increase CFSI awareness among the regional inspection staff. In 

addition, as the staff gathers more information during vendor inspections and commercial grade 

dedication pilot program inspections, it will assess the need for additional CFSI training. If the 

staff finds additional training is needed, it will coordinate the development of training with the 

Human Resources Training and Development staff and NRC regional offices to identify the 

proper scope, audience, and priority for the training. The staff expects to complete this action 

by October 2015. 

• The staff will evaluate the need to develop and implement a pilot program to inspect a 

limited number of licensees to assess the effectiveness of their 10 CFR Part 21, 

procurement, and commercial-grade dedication programs, and the need for ongoing 

inspections under the Reactor Oversight Process. 

The staff developed pilot program inspections as indicated in the action above. As of 

October 2014, the staff has completed pilot inspections at three nuclear power plants. The staff 

expects to complete the commercial-grade dedication pilot program by April 2015. 
The Commissioners 6 

• The staff will evaluate the need to provide additional guidance in NRC inspection 

procedures to assess the effectiveness of the programs and processes of licensees and 

suppliers of basic components to identify and prevent CFSI. 

To date, the inspectors performing the commercial-grade dedication inspections have not 

identified a need for additional inspection guidance in the CFSI area. While some issues were 

identified during the inspections with the dedication of commercial grade components, the 

issues were not related to CFSI. If, during the commercial-grade dedication inspections, the 

inspectors identify areas in the inspection procedures that require additional guidance, the staff 

will update procedures as needed. The staff expects to complete this action by June 2015. 

• The staff will develop new inspection guidance focused on suppliers of safety-related CDAs 

contained in the cyber security plan. 

The staff updated NRC Inspection Procedure 43002, “Routine Inspections of Nuclear Vendors,” 

to include additional inspector guidance for sampling cyber security requirements with regard to 

the criteria set forth in Appendix B to 10 CFR 50. Purchase orders that contain cyber security 

requirements from a licensee or applicant can be used by NRC vendor inspectors to assess a 

supplier’s activities related to procurement document control and/or control of purchased 

materials, equipment, and services.

• The staff will conduct NRC vendor inspections at suppliers of safety-related CDAs, in 

accordance with 10 CFR Part 21, and evaluate the results of these inspections to determine 

the need to expand the inspection sample to suppliers and subsuppliers of nonsafety-related 

CDAs. 

The staff has completed one vendor inspection at a supplier of safety-related CDAs and verified 

that the requirements for the development environment for digital assets and development of 

procedures for CDA identification and interface specifications were adequate. During the 

inspection, the staff reviewed a supplier’s design control planning processes and testing of 

safety-related components for new construction commercial nuclear plants in the U.S. This 

inspection assessed the supplier’s compliance with the requirements of 10 CFR Part 21, 

“Reporting of Defects and Noncompliance;” and the contractually imposed requirements of 

10 CFR 73.54, “Protection of Digital Computer and Communication Systems and Networks,” 

and 10 CFR Part 50, Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and 

Fuel Reprocessing Plants.” Inspection Report 99900404/2014-201 documents the results of 

this inspection (ADAMS Accession No. ML14058A995). The results of this one inspection did 

not indicate a need to expand the inspection sample to suppliers and sub-suppliers of 

nonsafety-related CDAs. As digital procurements by licensees increase, the staff will continue 

inspection efforts in this area and continue to evaluate the need to expand the scope of CDArelated inspections. The staff expects to complete this action by December 2017. 

• The staff will continue to inspect and verify licensees’ implementation of their cyber security 

programs including commitments for supplier oversight. The staff has issued Regulatory 

Guide 5.71 as an acceptable approach for licensees to meet the cyber security rule 

requirements. 

 
The Commissioners 7 

Full cyber security program implementation inspections—which will be completed over a 3-year 

period, expected to begin in 2015—will verify and assess implementation of appropriate system 

and service acquisition security controls, as required by the cyber security plan. The staff 

expects to complete this action by December 2018. 

• The staff will continue to implement the existing program for inspecting sources and 

materials to meet the governing regulatory requirements. The staff will continue to 

periodically inspect licensees and work with the Agreement States and the Food and Drug 

Administration. The NRC will perform an agencywide reassessment in the future to 

determine if any additional effort is needed in this area. 

The NRC has over 50 years of event data for materials users. There is no evidence that 

counterfeit parts in a device containing licensed material have resulted in an event. There is 

little need for parts replacement in devices containing sealed sources. For most devices, it is 

generally the sources that are replaced, and the sources can only be obtained from an NRC or 

Agreement State-licensed manufacturer and distributor. In addition, devices containing sealed 

sources may only be serviced by an NRC- or Agreement State-licensed service provider. This 

is a condition of a device holder’s radioactive materials license. For these reasons, there does 

not appear to be an incentive for counterfeiters to manufacture items for use in the materials 

arena, as there is not a sufficient market for a counterfeiter to make a profit. 

In March 2013, the staff issued Regulatory Issue Summary (RIS) 2013-01, “Use of Aftermarket 

Sealed Sources Registered under 10 CFR 32.210.” The RIS was issued to those licensed 

under 10 CFR Part 30, “Rules of General Applicability to Domestic Licensing of Byproduct 

Material.” The RIS provides guidance regarding the use in devices of replacement sealed 

sources (also called aftermarket sealed sources) that might be equivalent to original sources, 

but are not identified as such in the device registration certificate. The staff plans to issue a RIS 

(ADAMS Accession No. ML14192B407) by February 2015 to communicate how existing NRC 

regulations relate to CFSI. That RIS will also serve to raise awareness of the potential for CFSI 

to be used in the manufacture of sources and devices containing radioactive material. 

Based on the data collected over 50 years and actions taken or planned, the staff does not see 

the need to expand the CFSI program for materials users at this time. 

• The staff will continue to implement the existing NRC fuel cycle facility oversight programs 

and spent fuel storage and radioactive material transportation activities, which include 

quality assurance controls such as management measures that can contribute to the 

identification and prevention of CFSI. The staff will monitor the results from the CFSI task 

force’s efforts and will integrate any best practices and lessons learned into the program as 

necessary. 

The staff will be taking additional actions beyond those described in the planned action above 

based on lessons learned from participating in CFSI task force activities. (See “Additional 

Actions” below). 

Although the staff agrees that the current regulations for fuel cycle facilities, and spent fuel 

storage and transportation licensees are adequate to address CFSI, the staff recognizes the 

potential threat that such items represent in all of the NRC-regulated facilities. As such, it is 

important to raise awareness throughout the fuel cycle, and spent fuel storage and 
The Commissioners 8 

transportation community and to initiate proactive actions for the detection and prevention of 

CFSI in this sector. 

The staff has conducted periodic public meetings and conferences with licensees and certificate 

holders to discuss the current initiatives underway at the NRC and within the industry with 

regard to CFSI. During NRC’s 2014 Fuel Cycle Information Exchange, the staff used the 

operating experience panel discussions to raise awareness of the issue of CFSI. Additionally, 

to enhance CFSI knowledge and awareness among NRC personnel, the staff has provided, and 

will continue to provide, training opportunities for staff involved in activities that may be affected 

by such items. Selected staff members are also participating in training external to the agency 

to enhance staff knowledge and awareness of CFSI issues affecting various industrial sectors 

that may have common supply chains for parts and components with that of fuel facilities, and 

spent fuel storage and transportation licensees. 

Additional Actions: As part of further efforts to support CFSI initiatives, headquarters and 

regional staff will perform an evaluation of current fuel cycle, spent fuel storage and 

transportation inspection and oversight activities. This evaluation will focus on assessing the 

current program infrastructure to determine if the agency should add or enhance aspects related 

to CFSI. At the same time, the staff will collaborate with regional staff to provide appropriate 

training and information to NRC inspectors. The agency is currently upgrading the Fuel Cycle 

Operating Experience Program. During this upgrade, the staff will evaluate the best way to 

include CFSI as part of the program and provide the information to NRC inspectors and the 

regulated community, as applicable, so that the NRC staff, licensees and certificate holders are 

appropriately aware of CFSI risks.

• The staff will perform an agencywide reassessment in FY 2014 to determine the 

effectiveness of the implemented measures and pilot programs and to determine the need 

to implement additional CFSI countermeasures. Included in this assessment will be a 

review of CFSI operating experience and a collaboration of the working groups to assess if 

any changes need to be implemented. 

As part of efforts directed by the CFSI steering committee, the staff reviewed agency activities 

related to CFSI; domestic and international operating experience; and implementation of the 

aforementioned 19 action items from SECY-11-0154. Based on this review, it was apparent 

that existing agency processes have been effective in addressing CFSI. This review also 

reinforced the importance of open intra-agency communications in addressing complex 

challenges. Activities to address the 19 planned actions strengthen agency processes and 

stakeholder awareness of the challenges presented by CFSI. 

Licensees and industry organizations have also focused on the challenges presented by CFSI. 

In a joint effort with NEI, EPRI developed a guidance document for use by licensees to aid in 

preventing the introduction of CFSIs into nuclear facilities. The staff reviewed a draft of the 

EPRI guidance, which was the focus of an October 2013 public meeting. The staff provided 

comments (ADAMS Accession No. ML14104A737) for consideration in EPRI’s updated 

document, which was published August 2014 (ADAMS Accession No. ML14245A079). 

Although the staff did not formally endorse this document, the EPRI guidance document 

provides the necessary fundamental elements for detecting and preventing CFSI from affecting 

NRC-regulated activities. 
The Commissioners 9 

RESOURCE: 

The staff plans to expend approximately two full-time equivalent staff each year in fiscal year 

2015 and fiscal year 2016 to complete (or maintain) the new and ongoing actions that this paper 

describes. Staff have identified and placed all resources to complete these activities. 

COORDINATION: 

Staff has coordinated this action with the Office of General Counsel (OGC). OGC has reviewed 

this package and has no legal objection. 

The Chief Financial Officer has reviewed this package and determined that it has no financial 

impact. 

/RA/ 

 Mark A. Satorius 

 Executive Director 

 for Operations 
The Commissioners 9 

RESOURCE: 

The staff plans to expend approximately two full-time equivalent staff each year in fiscal year 

2015 and fiscal year 2016 to complete (or maintain) the new and ongoing actions that this paper 

describes. Staff have identified and placed all resources to complete these activities. 

COORDINATION: 

Staff has coordinated this action with the Office of General Counsel (OGC). OGC has reviewed 

this package and has no legal objection. 

The Chief Financial Officer has reviewed this package and determined that it has no financial 

impact. 

/RA/ 

 Mark A. Satorius 

 Executive Director 

 for Operations 

ADAMS Accession Number: ML14240A629 *via e-mail SECY-012 

OFFICE NRO/DCIP/IGCB* NRO/DCIP/IGCB* NRO/DCIP OIP* 

NAME DPasquale BAnderson MCheok (JBeardsleyfor) NMamish 

DATE 09/18/14 09/18/14 09/23/14 10/07/14 

OFFICE OE* FSME* NMSS* OI* 

NAME PHolahan (RFretz for) BHolian Chaney (CRoman for) CMcCrary 

(MFitzGibbon for) 

DATE 10/03/14 09/29/14 09/25/14 09/24/14 

OFFICE NSIR* NRR* OCFO* OGC* 

NAME JWiggins WDean (AHowe for) MWylie (DWilliams for) MDoane (GMizuno for) 

DATE 10/16/14 10/23/14 09/18/14 10/01/14 

OFFICE QTE* NRO/PRMS NRO EDO 

NAME CHsu CSchum (FMiller for) GTracy MSatorius 

DATE 09/04/14 10/27/14 10/31/14 1/8/15 

OFFICIAL RECORD COPY