USNRC

(U) Comment Resolution: 

ISFSI Security Rulemaking 

Regulatory Basis

Security Requirements for Facilities Storing 

Spent Nuclear Fuel

ML13086A150

12/17/2013

The comments on the draft regulatory basis have been summarized for purposes of clarity and 

conciseness and grouped together into 20 subject areas. Five individuals or groups submitted written 

comments on the draft regulatory basis.
-iTable of Contents

A. General Issues............................................................................................................... 1

B. Security and Security Plans ......................................................................................112

C. Technical Approach .....................................................................................................14

D. Backfit Issues ...............................................................................................................17

E. Overall Objectives of the Rulemaking.........................................................................18

F. Using a Risk-Informed and Performance Based Structure .......................................19

G. Impacts of Using a Denial Protective Strategy...........................................................22

H. General Security Requirements ..................................................................................23

I. Vulnerability Driven Physical Protection Program.....................................................25

J. Vehicle Barrier System ................................................................................................25

K. Physical Barrier Systems.............................................................................................26

L. Access Points and Search Equipment........................................................................27

M. Alarm Station Capabilities ...........................................................................................27

N. Independent Power Systems.......................................................................................27

O. Single Node Failures....................................................................................................28

P. Force on Force Evaluations.........................................................................................29

Q. Alternative Measures ...................................................................................................29

R. Security Program Reviews ..........................................................................................30

S. Key Facility Security and Emergency Response Information...................................30

T. Armed Security Officers and Armed Responders......................................................31

U. Proposed Dose Criterion Standard.............................................................................32
-1-

A. General Issues 

Comment Summary A-1 : The Department of Energy (DOE) recommends that the U.S. 

Nuclear Regulatory Commission (NRC) make clear in the regulatory basis for rulemaking that 

security at different types of collocated facilities will be appropriately considered and

distinguished. The draft basis does not appear to fully consider distinctions and different 

features between types of facilities which may be relevant in the risk-informed, 

performance-based approach of the future rulemaking. The NRC should ensure that the 

differences between independent spent fuel storage installation (ISFSI) and monitored 

retrievable storage installation (MRS) facilities are fully considered and taken into account as 

the rulemaking progresses. (1-1) (1-2)

NRC Response: Significant differences exist across the range of current and future spent 

nuclear fuel (SNF) and high level waste (HLW) storage facilities. Therefore, in developing the 

proposed regulations, the NRC staff plans to address these differences in a manner that 

reduces complexity by emphasizing commonalities, while also providing flexibility in recognition 

that differences exist. 

The NRC staff intends to develop proposed regulations for (NRC-regulated) SNF and HLW 

storage facilities that are consistent, to the extent practicable, across the range of ISFSIs that 

exist today. This would include ISFSI or MRS storage facilities that are operated by the DOE 

under an NRC license. 

A goal of the rulemaking will be to provide licensees with flexibility in developing their physical 

security plans (PSPs) in a manner that appropriately addresses their site-specific security 

issues. In considering this issue, the NRC staff intends to emulate the structure of the NRC’s 

final power-reactor security rulemaking (74 FR 13970; March 27, 2009) that provides for 

“alternative measures” (see Title 10 of the Code of Federal Regulations (10 CFR) 73.55(r)).

Comment Summary A-2 : The Nuclear Energy Institute (NEI) is concerned with a number of 

approaches proposed within the draft regulatory basis document. The industry is concerned

with an approach that would impose significant new security measures without any newly 

identified vulnerabilities or analysis of an increased threat environment. NEI is not aware of any 

new threats that would require additional security measures beyond those currently mandated 

by the SNF storage additional security Orders. These Orders mandate moderate security 

measures based upon NRC evaluations of facilities in light of the threat environment. They also 

considered the potential threat posed by the type of material stored and the extremely robust 

construction of the various [SNF] canisters and storage facilities in use. If there are no 

significant changes to the threat environment or significant vulnerabilities identified through 

comprehensive analysis, then the industry believes there is not sufficient regulatory basis for a 

rulemaking that would impose new requirements or methods beyond those currently required by 

the Orders. It is the industry’s position that if there are, in fact, new threats or design 

vulnerabilities that have been evaluated by the NRC, that this information should be 

communicated to licensees.

The industry requests a closed meeting with the staff to discuss new threat information or 

vulnerability studies that would or should affect the security measures at facilities storing SNF 

and HLW above those mandated by the security Orders. (2-a; 2-d)
-2-

NRC Response: The NRC staff conducted three closed meetings, one at the safeguards 

designation and two at the classified national security information level, to discuss current ISFSI 

and MRS threat and vulnerability information. Approximately 50 cleared stakeholders attended 

the first two presentations and discussions, 87 attended the third. Industry has also established 

a classified working group in support of this rulemaking. The industry working group met with 

the NRC staff for the first time on November 16, 2011, and continues to meet with NRC staff on 

an as needed basis. Because the threat and vulnerability information discussed at these three 

closed meetings – on which the draft regulatory basis document is partially based -- is sensitive 

security information, it cannot be discussed further in this public document.

Comment Summary A-3: NEI has a concern with the proposed use of a new methodology 

(CARVER analysis) that is different from the Design Basis Threat (DBT). The CARVER 

analysis is based upon evaluating potential vulnerabilities to various capabilities that are 

arbitrarily selected without consideration for a design basis or actual threat intelligence. 

Rulemaking that would implement this approach would only add to the regulatory instability that 

currently exists in security and likely result in misapplication of security measures. (2-b)

NRC Response: The NRC staff proposed the use of CARVER methodology as a potential 

method to evaluate applying the dose-based concept (discussed in the draft regulatory basis), 

and the NRC staff understands that NEI prefers the use of a DBT-based approach. But the 

CARVER analysis is commonly used within the federal government as an offensive target 

analysis tool and it has become a very effective defensive tool for critical infrastructure 

protection. The CARVER analysis allows the user to evaluate the vulnerabilities of a specific 

facility using the latest threat information and the staff takes issue with the comment that such 

analyses are not based on actual threat intelligence.

Further, given that the ISFSI security regulations have not changed since 1998, the NRC staff

disagrees that regulatory instability exists. 

Comment Summary A-4: While industry appreciates the opportunity to comment on the draft 

basis document, we encourage the NRC to make a draft of the proposed rulemaking available 

as soon as practical so that stakeholders have the opportunity to provide additional feedback as 

the proposed new requirements crystallize. Also, NEI encourages the NRC staff to provide a 

clear technical and regulatory/legal bases for specific changes to the existing regulatory scheme 

that are included in the proposed rule. (2-1)

NRC Response: NRC staff intends to make the proposed rulemaking available for public 

review and comment. The NRC staff agrees that clear technical, regulatory, and legal bases for 

the proposed rulemaking are necessary. 

Comment Summary A-5 [1] : In the draft regulatory basis, the NRC staff states that “the use 

of a ‘denial of task’ protective strategy raises issues of sufficient technical complexity to 

necessitate prior staff review and approval of a licensee's security plan.” The NRC staff based 

this conclusion on experience it gained during reviews of reactor security plan changes 

necessary to implement the security and DBT orders, and its desire to maintain a separation 

between NRC security plan review and approval and NRC inspection functions. The NRC staff 

then goes on to explain that the change control process for ISFSI emergency plans is provided 

in 
-3-

10 CFR 72.44(e)(for specific licensees) and 50.54(p)(1)(for general licensees). Both provisions 

allow licensees to make changes to emergency plans, without prior NRC approval, provided that 

the changes do not decrease the effectiveness of the emergency plan. If changes will decrease 

the effectiveness of the emergency plan, both general and specific licensees are required to use 

the license amendment process to obtain NRC approval of such changes prior to their 

implementation.

Despite the provisions contained in 10 CFR 50.54(p)(1), the staff plans to revise the regulations 

to require “a reactor licensee, associated with a general-license ISFSI who chooses to employ a 

‘denial of task’ protective strategy for the ISFSI, to submit its security plan to the NRC for prior 

review and approval.” (draft regulatory basis, at pp. 10). The NRC staff goes on to state that 

such submittals “would be a specific licensing action under the associated Part 50 license that 

would create a potential hearing right under Section 189 of the AEA.” Although the staff does 

not specify what type of “specific licensing action” review and approval of the plan would 

constitute, it appears that the staff is drawing an analogy to the license amendment process.

NEI believes that the NRC staff is unnecessarily conflating its desire to review and approve

changes to licensee emergency plans implementing a “denial of task” strategy and the need for 

a license amendment or other licensing action. Specifically, as the staff points out, change 

control for emergency plans is currently governed by Sections 72.44(e) and 50.54(p). The 

regulatory standard for requiring a license amendment in those provisions is whether a 

proposed change would decrease the effectiveness of the security plan. In this regard, the staff 

acknowledges that “[i]n all likelihood, a general-license ISFSI's shift to a denial protective 

strategy would not decrease the effectiveness of the associated power reactor's security plan 

under 10 CFR 50.54(p)(1)” (draft regulatory basis, at pp. 10). Thus, under the current regulatory 

scheme, it is unlikely that such a change would require a license amendment. Despite the fact 

that the current regulatory standard - which is a condition in all Part 50 operating licenses -

would not likely require a license amendment, the staff seems to be proposing that review and 

approval of certain plan changes (i.e., a general licensees’ adoption of a “denial of task”

strategy) must be accomplished through “a specific licensing action covered by section 189 of 

the AEA.” NEI disagrees with this proposition. Specifically, NEI believes that the staff can

require prior review and approval of changes to security plans implementing a “denial of task”

strategy at generally licensed ISFSIs, without requiring a license amendment. Indeed, one of 

the purposes of the staff's review and approval could be to ensure that the plan changes do not

decrease the effectiveness of the licensee's security plan. In this way, the NRC would be

requiring review and approval of this limited class of changes, in part, to ensure that a license

amendment is not required. See Cleveland Electric Illuminating Company (Perry Nuclear Power

Plant, Unit 1), CLI-96-13, 44 NRC 315, 328-29 (1996) (acknowledging that not every change 

that occurs at a nuclear power plant, even if significant, represents a license amendment and 

that requiring approval of certain licensee-initiated changes before they go into effect is a 

legitimate method of enforcing existing license requirements). This approach would leave the 

long-standing “decrease in effectiveness” change control standard contained in 50.54(p)(1), 

which has been in place for over 36 years, unchanged. See 38 Federal Regulations. 30538; 

November 6, 1973. The approach described above is also more consistent with the section 

218(a) of the Nuclear Waste Policy Act (NWPA) than the staff's proposed approach. 

The current Part 72 general license requirements implement Sections 133 and 218(a) of the 

NWPA and the staff recognizes that “Section 218(a) mandated that the Commission by rule 

approve technologies for the dry storage of spent fuel at civilian nuclear power reactors ‘without 
-4-

to the extent practicable,’ the need for additional site specific (i.e. licensing) approvals by the 

Commission”( draft regulatory basis, at pp. 10, FN 15). But the staff goes on to reason that 

because Section 218(a) does not prohibit a site-specific licensing actions under the ISFSI 

general licensing process, its proposal to require a site-specific licensing action to approve plan 

changes is consistent with the NWPA. Draft regulatory basis, at 16-17. This reasoning turns 

Section 218(a) on its head. As the staff seemingly acknowledges in footnote 15, Section 218(a) 

imposes an affirmative duty on the NRC to use rulemaking to approve technologies for dry 

storage and to avoid (to the extent practicable) the need for additional 

site-specific licensing actions. Simply pointing out that Section 218(a) does not prohibit all 

site-specific licensing actions to justify imposition of what, in our view, amounts to an 

unnecessary site-specific licensing requirement for generally licensed ISFSIs essentially ignores 

the affirmative duty imposed on the NRC by Section 218(a). Therefore, NEI recommends that 

the NRC staff craft a proposed rule, using an approach like the one outlined above, that 

achieves its stated goal of reviewing and approving certain plan changes for general licensees, 

while avoiding – “to the extent practicable” - the need for additional site-specific licensing 

actions. This approach avoids unnecessary changes to the existing, long-standing change 

control process and is more consistent with Section 218(a) of the NWPA. (2-2)

NRC Response: For the reasons discussed below, the NRC staff disagrees with this comment. 

The staff proposes to require reactor licensees holding general ISFSI licenses, who propose 

converting to a denial of task protective strategy for the ISFSI, to submit their revised security 

plans to the NRC for prior review and approval. Such submittals will require use of a license 

amendment process. This response begins by providing the following background information, 

setting forth the considerations on which the planned rulemaking would be based. 

In its SRM dated November 16, 2010 (on SECY 10-0114) – other than expanding the scope of 

the planned rulemaking to include spent nuclear fuel and high-level radioactive waste stored at 

monitored retrievable storage installations -- the Commission stated that the staff should 

continue following the path laid out in SECY-07-0148. The discussion in Enclosure 1 to 

SECY-07-0148, under the sub-heading “Licensee Submittal of Security Plans for NRC Prior 

Review and Approval,” is particularly relevant here, and the portions of that discussion which 

remain applicable are summarized below.

To prevent a successful terrorist attack, all ISFSI licensees now use the “detect, assess, and 

communicate” protective strategy, and none implement a denial of task protective strategy. 

However, to meet the Part 73 radiological dose criterion that the staff plans to develop, those 

ISFSI licensees who cannot meet the dose limit through the use of additional security measures 

and who lack the ability to expand the distance between their storage casks and the nearest 

boundary of the controlled area, may need to shift to a denial of task protective strategy. 

The shift to a denial of task protective strategy in the above-described site-specific situations 

raises issues of sufficient technical complexity to necessitate prior staff review and approval of a 

licensee's security plan. The staff bases this conclusion on: (1) experience gained in the 

2003-2004 reviews of the changes to reactor security plans to implement the security and DBT 

orders; and (2) the view that under 10 CFR 50.54(p), submittal of an ISFSI security plan 

reflecting a shift to a denial task protective strategy would in effect be the submittal of a new 

plan, rather than a proposed revision of an existing plan.
-5-

The staff further stated in Enclosure 1 that if ISFSI licensees were to apply for authorization to 

use enhanced weapons (e.g., machine guns) to protect their ISFSIs, as provided under 

Section 161A of the AEA, such licensees would be required to submit their security plans to the 

NRC for prior review and approval. 

The planned rulemaking would be intended to facilitate the establishment of a nationally 

consistent security baseline, and would be applicable to all current ISFSI licensees (whether 

they hold general or specific licenses), and any future ISFSI or MRS applicants. Licensees who 

could only meet the 5-Rem limit by shifting to a denial of task protective strategy would be 

required to submit security plan reflecting this shift; to the NRC for prior review and approval. 

All such submittals would be processed as license amendment requests, under either 10 CFR 

72.56 for specific ISFSI licenses, or 10 CFR 50.90 for general ISFSI licenses. Once such a new 

security baseline has been achieved, subsequent changes to ISFSI and MRS security plans 

that a licensee determines do not decrease the effectiveness of its physical security program 

would not require prior NRC review and approval, pursuant to the existing 10 CFR 50.54(p) 

requirements for general license ISFSIs, or the 10 CFR 72.44(e) requirements for specific 

license ISFSIs, whichever is applicable.

In its comment, NEI argues that, with respect to generally licensed ISFSIs, the NRC staff can 

subject a licensee’s requested establishment of a denial of task protective strategy to prior 

review and approval without using a license amendment process. Relying on the Commission’s 

decision in Perry, NEI argues in support of its position that (1) not every change that occurs at a 

nuclear power plant, even if significant, represents a license amendment; and (2) requiring 

approval of certain licensee-initiated changes before they go into effect is a legitimate method of 

enforcing existing license requirements. 

The NRC staff does not agree with this NEI argument. In Perry, the Commission found that 

NRC staff approval of a licensee proposal to make changes to the plant’s reactor vessel 

material specimen withdrawal schedule, once the withdrawal schedule was removed from the 

licensee’s technical specifications, would not require a license amendment. The Commission 

concluded that the withdrawal schedule changes would neither alter the terms of the Perry

license nor allow the licensee any greater operating authority. The Commission noted that the 

withdrawal schedule was established by a standard of the American Society for Testing and

Materials (ASTM), which was incorporated by reference in Appendix H of 10 CFR Part 50. In 

fact, the licensee’s license “specifie[d] an NRC-approved methodology - the ASTM standard - to 

be used in developing either an initial or a revised schedule.” CLI-96-13, 44 NRC at 328. The 

ASTM standard established “specific technical criteria” and “delineated parameters for 

Cleveland Electric to use in calculating an appropriate withdrawal schedule.” In these 

circumstances, the Commission decided that staff approval of withdrawal schedule changes that 

met the applicable ASTM standard did not grant the Perry licensee greater operating authority, 

so a license amendment would not be required.

In contrast to the facts of Perry, the NRC’s 10 CFR 50.54(p) security plan provisions (and the 

related requirements referenced therein) do not contain specific technical criteria that can be 

generically applied to evaluate proposed changes to security plans. A reactor licensee’s 

security plans (i.e., the physical security plan, the safeguards contingency plan, the cyber 

security plan, and the guard training and qualification plan) are specific to that licensee and its 

facility. 
-6-

These licensee-unique plans – which include the 10 CFR 73.55 performance objectives 

referenced in both Section II (“Nuclear Power Plant Safeguards Contingency Plans”) of Part 73 

Appendix C, and in 10 CFR 50.34(c)-(d) -- give reactor licensees the flexibility to develop their 

security plans in a manner that takes into account a reactor site’s individual characteristics. For 

example, the Licensee Planning Base component of a safeguards contingency plan must 

address factors that are specific for each reactor facility, such as its physical layout and its 

location relative to nearby towns, rail lines, roads, airports, and hazardous material facilities. 

See Part 73 Appendix C, Section II.B.3.b. Similarly, a reactor licensee’s safeguards 

contingency plan must list the law enforcement agencies that are available to provide 

assistance, and the plan must discuss other facility-specific factors such as State laws and local 

ordinances that will govern a licensee’s response to security incidents. See Part 73 Appendix C

Section II.B.3.d-e. 

In revising the above requirements in March 2009, the NRC emphasized their site-specific 

nature, as follows:

The primary focus of the security plans is to describe how the licensee will satisfy 

Commission requirements to include how site-specific conditions affect the measures 

needed at each site to ensure that the physical protection program is effective. Security 

plans include the physical security plan, training and qualification plan, safeguards 

contingency plan, and cyber security plan. 

74 Fed. Reg., at 13960, col.2 (Mar. 27, 2009). More specifically, regarding the revised Licensee 

Planning Base provisions discussed above, the NRC described the intent of these requirements 

as follows: 

This category of information focuses on factors that affect safeguards contingency 

planning specific to each facility. The licensee planning base must document the 

site-specific organizational structure of the security response organization, site physical 

layout considerations, safeguards systems, the protective strategy, law enforcement 

assistance, policy constraints, and assumptions and administrative and logistical 

considerations that could have bearing on the implementation of the licensee’s 

[safeguards contingency plan] (74 Federal Regulation, at 13966, col.3 (Mar. 27, 2009)). 

Id., at 13966, col.3. Consequently, the NRC’s approval of a general license ISFSI’s physical 

security plan, safeguards contingency plan, cyber security plan, or guard training and 

qualification plan, is more than a ministerial, non-discretionary act. Consideration of the 

acceptability of such plans would not involve, as in Perry, a simple review of a change in a 

withdrawal schedule to determine if previously-approved objective criteria are satisfied. Rather, 

the determination of the acceptability of security plans necessitates consideration and resolution 

of site-specific technical and regulatory issues - none of which would be the subject of objective 

evaluation criteria. In some instances, the evaluation of such plans involves the balancing of 

competing regulatory objectives and policies. Thus, NRC approval of these types of security 

plans constitutes an exercise of agency discretion. 

In Perry, because the staff did not exercise discretion and relied on objective, NRC-approved 

standards, staff approval did not give the licensee greater operating authority than it already 

had. In contrast, under the planned rulemaking described in SECY 07-0148 and in the 2009 

draft regulatory basis, the NRC staff’s review of security plan changes proposing to establish a 
-7-

denial protective strategy would involve staff’s exercise of its discretion due to the site-specific 

nature of the plans and a lack of objective, previously-approved criteria. Staff approval under 

these circumstances would grant a general ISFSI licensee authority to operate in a manner that 

would be different, or greater, than the manner in which the licensee was previously authorized 

to operate. For example, ISFSI guards would be authorized to use deadly force. 

For these reasons, under the principles of Perry, a security plan change that sought to 

implement or reflect a licensee’s proposed adoption of a denial protective strategy regarding its 

ISFSI would, if approved, grant the licensee greater operating authority than it previously 

possessed, and would thus require the proposal to be processed as a license amendment 

request. 

Comment Summary A-5[2] : The existing 10 CFR part 72 general license requirements 

implement sections 133 and 218(a) of the Nuclear Waste Policy Act (NWPA). Section 218(a) of 

the NWPA authorized the DOE to establish “one or more technologies that the Commission 

may, by rule, approve for use at the sites of civilian nuclear power reactors without, to the 

maximum extent practicable, the need for additional site-specific approvals by the Commission”. 

NEI argues that this provision imposes an “affirmative duty” on the NRC to use rulemaking to 

approve technologies for dry storage and to avoid (to the extent practicable) the need for 

additional site-specific licensing actions. 

Therefore, NEI recommends that the NRC staff craft a proposed rule for general ISFSI 

licensees which achieves its stated goal of reviewing and approving certain plan changes for 

general licensees, while avoiding - to the extent practicable - the need for additional site-specific 

licensing actions. Such an approach would avoid unnecessary changes to the existing, 

long-standing change control process provided by 10 CFR 50.54(p)(1), and would be more 

consistent with Section 218(a) of the NWPA. 

NRC Response: The NRC staff disagrees with this affirmative duty argument. The inclusion of 

the phrase “to the maximum extent practicable” in NWPA section 218(a) cannot reasonably be 

read as prohibiting the NRC from exercising discretion on how best to implement its 

responsibilities under the NWPA. Such a prohibition would be contrary to the NRC’s general 

rulemaking authority, provided by AEA Section 161.b., giving the NRC discretion on how best to 

implement its statutory responsibilities. While by enacting NWPA Section 218(a) Congress 

arguably intended to limit the need for NRC adjudicatory hearings by reducing the need for sitespecific approvals, Congress could have prohibited NRC hearings by omitting from NWPA 

section 218(a) the phrase “to the maximum extent practicable.” NEI does not identify any NWPA 

legislative history in support of its “affirmative duty” argument, and the NRC did not find any 

NWPA legislative history on this issue. 

Further, as discussed above, in Response to Comment A-5[1], the staff finds that in order to 

establish a nationally consistant security baseline, licenses who could not only meet the planned 

5-Rem limit by shifting to a denial of task protective strategy should be required to submit a 

security plan reflecting this shift to the NRC for prior review and approval, and all such 

submittals should be processed as license amendments, under either 10 CFR 72.56 for specific 

licenses, or 10 CFR 50.90 for general ISFSI licenses. The staff additionally finds that, with 

respect to these ISFSI sites where the planned 5_Rem could only be met by shifting to a denial 

of task protective strategy, the NRC’s prior review and approval of a security plan reflecting this 

shift is necessary to meet the 10CFR 73.55(b) objective providing high assurance that activities 

involving SNM are not inimical to the common defense and security and do not constitute an 
-8-

unreasonable risk to the public health and safety. This objective is applicable to the physical 

protection programs the Part 50 licensees have in place at all power reactor sites, where the 

implementation of a denial of task protective strategy (i.e., the ability to “detect, assess, interdict, 

and neutralize threats” as specified in 10 CFR 73.55(b)(3)(i)) is already required. Extending this 

requirement ISFSI sites where the planned 5-Rem limit could only be met by shifting to a denial 

of task protective strategy is necessary to maintain a consistent level of protection across all 

sites which implement a denial of task strategy. Also, as indicated in the SOC for the final 10 

CFR 73.55 rulemaking, the NRC’s intent is to establish requirements that will prevent spent fuel 

sabotage. See 74 Fed. Reg. at 13936, col.3 (Mar. 27, 2009).

Accordingly, the NRC staff considers it within the scope of the Commission’s authority and 

discretion under the NWPA to determine that the planned changes to certain components of 

general ISFSI licensee programs (e.g., physical security and emergency response plans 

involving a denial of task protective strategy) should require prior review and approval by the 

NRC staff. These issues will be addressed further in the proposed rulemaking.

Comment Summary A-6 : Instead of requiring that all ISFSI licensees be required to "prevent 

spent fuel sabotage" by providing a physical protection program that can protect ISFSIs from the 

design basis threat (DBT), which would be consistent with the requirements of 

10 CFR 73.55(b)(3) for power reactor licensees, the NRC proposes discontinuing the 

application of the DBT for radiological sabotage for all ISFSIs. This would create a double 

standard for protection of spent fuel at reactor sites depending on whether the spent fuel is 

located in the reactor spent fuel pool or is stored at a co-located ISFSI. (3-1)

NRC Response: The commenter is correct that under the NRC’s proposed approach to

discontinue the application of the DBT for radiological sabotage for all ISFSIs the spent fuel in a 

co-located reactor’s spent fuel pool , would be treated differently than the spent fuel located in 

an ISFSI. In the staff’s view, such disparate treatment is warranted based on 1) the additional 

decay time from discharge from the reactor affecting the concentration or presence of specific 

radionuclides; and 2) the total mass of radioactive material that could be subject to an assault is 

greater in a spent fuel pool than it is in a storage cask. 

Comment Summary A-7 : The text of the draft regulatory basis (page 14, H, second sentence) 

appears to describe a continuously evolving, unstable regulatory environment that is contrary to 

good regulation and Commission policy. As provided in the overarching comment, ISFSIs 

should have security measures determined by a design basis that is informed by the threat

environment and bounded by those measures that should reasonably be expected to be 

employed by public utilities with public security forces, supported by law enforcement, to protect 

these extremely robust structures. Any additional measures deemed necessary due to an 

escalation in the national threat environment should then be the responsibility of the United 

States government. This provides stability and consistency in regulation that enables sound 

design of facilities and their associated security measures and enables effective NRC oversight.

(2-31)

NRC Response: Although one of the NRC’s goals is regulatory stability, the NRC may need to 

establish new security requirements due to the evolution of the current threat environment or to 

changes in the NRC’s understanding of ISFSI vulnerabilities. The NRC staff coordinates with 

the intelligence and law enforcement communities in evaluating the threat capabilities of 

potential adversaries. The NRC staff also evaluates the potential impact of these capabilities on 
-9-

ISFSI and MRS designs over time. Consequently, changes in adversary capabilities over time 

may result in changes to protective requirements, over the extended lifetime of ISFSIs.

For example, following the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma 

City, Oklahoma, the NRC changed the size of a vehicle bomb considered in the adversary 

characteristics, and added new regulatory requirements to install vehicle barriers for certain 

classes of facilities. At that time, the NRC concluded that vehicle barrier systems (to mitigate 

the effects of a vehicle borne improvised explosive device (VBIED)) were required for power 

reactors, but not for ISFSIs. However, in the 2002 ISFSI security orders, the NRC revised its 

approach and required temporary vehicle barriers to mitigate the effects of a VBIED. In the 

2009 draft regulatory basis, the NRC staff indicated that vehicle barriers to mitigate the effects 

of a VBIED would be a permanent requirement. This is an example of the NRC’s proposed 

requirements evolving due to changes in its understanding of ISFSI vulnerabilities.

Additionally, regarding aircraft attacks, the NRC in its 2009 SOC for the final power reactor 

security rulemaking recognized that the protection of NRC-regulated facilities against such 

attacks “is beyond the scope of a licensee’s obligations,” 74 Fed. Reg. at 13935, col.3 (Mar 27, 

2009). But the NRC in that rulemaking nonetheless promulgated 10 CFR 50.54(hh), requiring 

pertinent part that the reactor licensees develop procedures that would “ mitigate the 

consequences” of aircraft impacts. 10 CFR 50.54(hh)(1)(iv). Further background on related 

issues pertaining to the military’s responsibility to actively protect against airborne threats – is 

provided in the 2007 SOC for the final rule revising the 10 CFR 73.1 DBT requirements, in 

which the Commission distinguishes these requirements from those in 10 CFR 50.13. See 72 

Fed. Reg. 12705, at 12710 and 12714-15 (Mar. 19, 2007). Consequently, the NRC staff intends 

to evaluate in the proposed rulemaking whether language similar to the provisions of 10 CFR 

50.13, “Attacks and destructive acts by enemies of the United States; and defense activities,” 

should be added to 10 CFR Part 72. 

Comment Summary A-8 : The Prairie Island Indian Community (PIIC) has not yet been 

consulted on the draft regulatory basis for the proposed rulemaking. Particularly where, as 

here, the issues involved are highly technical and beyond the expertise of non-nuclear industry 

engineers and experts, meaningful consultation is needed to fully advise the Tribe of the issues 

so that it understand the proposed revisions to the ISFSI security requirements, why the 

changes are being made, whether the proposed revisions are sufficient to address all known 

security risks, and how the proposed revisions might affect the Community, its security, and the 

wellbeing of members. In short the Community hereby requests a government-to-government 

consultation on the proposed revisions. (5-1)

NRC Response: The staff began initial government-to-government discussions (on the

proposed rulemaking and its regulatory basis) with the PIIC on August 10, 2010, and will 

continue to ensure that PIIC members are kept fully informed on these issues.

Comment Summary A-9 : There is no mention of the word "war" in the draft regulatory basis

or any of the related documentation. Despite the president assuring the country that his 

administration was "at war" with the terrorists, clearly the NRC has not gotten the message.

Use of the term "radiological sabotage” belies the fact that ISFSIs and MRSs are in fact one part 

of a binary weapon not unlike the munitions depots in Iraq. The lesson learned in Iraq is you 

don't leave munitions that can be used against you, unguarded. This is particularly true when 
-10-

these binary munitions are stored on your home soil, as when spent fuel rods are bundled 

together in dry waste storage casks at ISFSIs on nuclear power plant sites. (4-1)

NRC Response: The NRC staff disagrees with the assumptions and premises stated in the 

comment. Physical security measures including armed personnel and intrusion detection 

systems are currently in place at all licensed spent nuclear fuel storage installations in the 

United States. As discussed in the Comment Summary A-7 response, licensee security 

programs are not required to defend against attacks that rise to the capabilities of “enemies of 

the United States.” Defending against such attacks is a responsibility of U.S. national 

authorities, not individual NRC licensees. In the proposed rulemaking, the NRC staff intends to 

evaluate whether language similar to 10 CFR 50.13 should be included in 10 CFR Part 72.

The NRC staff does not agree that SNF or HLW are part of, or can be considered, a “binary 

weapon.” The term binary weapon is commonly defined as a chemical weapon consisting of a 

projectile containing two substances separately that mix to produce a lethal agent when the 

projectile is fired. U.S. chemical munitions are examples of binary weapons; SNF and HLW are 

not. Further, there is no relationship between a binary weapon and the NRC regulatory term 

“radiological sabotage,” as defined in 10 CFR Part 73 

Comment Summary A-10 : How can the public be confident that risk calculations done by 

various nuclear operators will be accurate?. The draft Regulatory basis seems to leave 

everything up to the discretion of the individual nuclear plant owners. (4-5)

NRC Response: Applicants for a license, as well as licensees, are routinely required to 

evaluate hazards and perform engineering calculations for their facility. These calculations are 

either subject to prior NRC review and approval or to review by NRC inspectors after 

implementation. As discussed in the draft regulatory basis, licensees would take release 

fraction information for a specific security scenario, adjust this information to reflect the actual 

SNF burn-up and time from discharge from the reactor, and apply site specific information to 

calculate dose consequences. Accordingly, these calculations require a lot of site-specific 

information, and such calculations are therefore best performed by the licensee. The results of 

these calculations would be subject to review and approval by the NRC staff.

Comment Summary A-11 : As stated on page 24, "NRC recognizes that implementing these 

new provisions is not simple..." and further recognizes the complexity that may be involved with 

analysis and development of solutions. If this [dose based] approach is adopted, licensees are 

presented with "performance based" options that potentially could include significant facility 

modifications beyond installing additional security equipment. To allow one year to analyze and 

develop solutions and only an additional 6 months to be in full compliance, would not enable 

licensees to conduct these modifications using effective change management that is critical to 

ensuring quality and safety.

In addition, an NRC webinar presented a schedule showing that NRC guidance would not be 

issued until months after the final rule was published. The guidance is critical information that 

licensees require to do evaluations and develop solutions. Delayed release of guidance will not 

allow for effective change management.

Industry experience regarding similar security-related modifications has established that a

minimum of three to five years is required in order to allow sufficient time for major project
-11-

budgeting, engineering design, and procurement activities to take place without incurring an

extremely negative impact on previously developed licensee resource utilization plans. (2-57)

NRC Response: In accordance with Commission policy, the NRC staff plans to publish draft 

guidance for comment with the proposed rule, and publish final guidance with the final rule.

Additionally, rule implementation dates will be established taking into consideration stakeholder 

comments.

Comment Summary A-12 : NEI requests that the staff conduct a review of lessons learned 

from the 2009 Part 73 power reactor security rulemaking effort. This is particularly necessary in 

the area of cost estimates associated with the rulemaking, and industry involvement in 

developing related guidance. (2-c)

NRC Response: The NRC staff conducted a lessons-learned review following the power 

reactor security rulemaking, and is mindful of these issues. NRC staff has engaged with the 

industry working group to request industry inputs on costs of implementation in order to develop 

an accurate draft Regulatory Analysis. NEI will be able to comment on the draft Regulatory 

Analysis, and its cost estimates. A final Regulatory Analysis will be developed that considers 

submitted comments and will accompany the final rule.

Comment Summary A-13 : To the best of the PIIC’s knowledge, no cask used to date has 

ever been unloaded and examined to ascertain the integrity of a cask and how its components 

and materials have withstood the effects of the heat and radiation of the spent nuclear fuel, as 

well as the long-term exposure to the elements (i.e. the freeze/thaw cycle). (5-2)

NRC Response: SNF storage casks have been unloaded after substantial storage time and 

their contents examined, as detailed in NUREG/CR-6745, Dry Cask Storage Characterization 

Project–Phase 1: CASTOR V/21 Cask Opening and Examination, September, 2001, and 

NUREG/CR-6831, Examination of Spent Fuel PWR Fuel Rods After 15 Years in Dry Storage, 

September, 2003. Specifically, in the NRC staff’s review for the Surry and H. B. Robinson ISFSI 

license renewal applications, the NRC staff evaluated the technical data resulting from an 

NRC-supported research program at the Idaho National Laboratory (INL) and also considered 

operational experience with spent fuel storage casks used at the Surry ISFSI. Under the INL 

research program, INL opened a storage cask in an INL hot cell after the spent fuel had been 

stored for approximately 15 years. At Surry, several casks were also opened after less than 15 

years of storage as a result of some faulty weather covers [on the storage casks] - which were 

subsequently corrected. Moreover, the NRC’s final rule (76 FR 8872; February 16, 2011) on 

extending the license term for Part 72 facilities directly addressed this issue and described the 

results of these examinations for both the spent fuel and the storage cask (see the detailed 

discussion in Section II.C at page 8874 of this final rule).

B. Security and Security Plans

Comment Summary B-1: The draft regulatory basis does not appear to consider situations in 

which the security plan for an NRC-licensed facility should be coordinated with the security of a

DOE-regulated facility, such as at Idaho Nuclear Technology and Engineering Center (INTEC). 

(1-3)
-12-

NRC Response: The NRC staff had not proposed language in the draft regulatory basis to 

require coordination with co-located facilities. However, the NRC staff’s view is that most 

licensees (including DOE) would integrate the physical security measures for their ISFSI or 

MRS with any adjacent, similar facilities. Therefore, the NRC staff’s view is that licensees can 

coordinate security planning and encourages such action; however, because these facilities are 

licensed separately by the NRC or are not licensed by the NRC (in the case of DOE’s ISFSIs), 

the NRC may not require integration of security plans. Additionally, as noted in the response to 

Comment Summary A-1 above, licensees with unique circumstances will be able to propose 

“alternate measures” (using an approach similar to 10 CFR 73.55(r)).

Comment Summary B-2: A coordinated approach to security should be encouraged for all 

co-located secure facilities. Coordination details should be developed in the site specific 

requirements discussed in the draft regulatory basis. (1-4)

NRC Response: As discussed in the response to Comment Summary B-1 above, because 

these facilities are licensed separately by the NRC or are not licensed by the NRC, the NRC 

may not require integration of security plans. Thus, the NRC’s view is that such information is 

more appropriately incorporated into NRC guidance documents rather than into the proposed 

regulations.

Comment Summary B-3: The NRC should confirm that coordination in security will be 

supported at other types of secure co-located facilities, including DOE-regulated facilities such 

as “INTEC.” DOE recognizes that, in locations where both NRC and DOE exercise their

regulatory authority under the Atomic Energy Act of 1954, as amended, past practices of

coordinating security plans through measures such as interagency Memoranda of

Understanding (MOUs) have worked well, and such coordination efforts should continue. (1-5)

NRC Response: The NRC recognizes that DOE has an oversight responsibility for other 

(non-NRC regulated) facilities at INTEC. The NRC expects that measures such as MOUs may 

be useful in delineating oversight responsibility, especially where shared resources are involved,

(e.g., alarm stations and response forces). Additionally, as discussed in Comment Summary

A.2 above, DOE would have the ability to also employ “alternate measures” due to any unique 

situations at INTEC.

Comment Summary B-4: It is deeply disturbing that the NRC staff has proffered a draft 

regulatory basis that provides for no force-on-force guarding of the ISFSIs by on-site security at 

the nuclear plants. Instead, the NRC proposes to leave the protection of the casks to local law 

enforcement under the Detect, Assess, and Communicate (DAC) strategy. In the event of a 

nuclear incident there will be a huge traffic jam unless the public exerts tremendous discipline. 

Even then, unless the local law enforcement happens to be upwind of the ISFSI incident, there 

is no way that they [i.e., public officials] would be able to arrive at the scene because of the 

extraordinary dense vehicle traffic from the mass public exodus. (4-2)

NRC Response: The NRC staff understands the comment as stating the following concerns: 

(1) that the proposed rule will not include a force-on-force (FOF) requirement applicable to all 

ISFSIs and MRS’ and (2) that if an area is evacuated in the event of a security event local traffic 

would impede local law enforcement from responding. On the FOF issue, the NRC staff’s view 

is that current security measures provide adequate protection of public health and safety and 

the common defense and security, and that a FOF requirement applicable to ISFSIs and any 
-13-

future MRS facilities is therefore not warranted. On the traffic issue, given the timelines for 

security events, the NRC staff view is that LLEA personnel would be able to respond to the site, 

if called upon to do so, before ingress was blocked by the evacuating local populace. 

Evacuation decisions are made by State officials and are implemented in conjunction with local 

law enforcement (e.g., appropriate personnel are in place to provide for traffic control)

Comment Summary B-5: To determine what measures are warranted in protecting the ISFSIs 

one must first assess the costs associated with a successful attack on these liabilities. The 

redacted reference document [Adams Accession No. ML080030050] addresses 

“implementation costs" and "potential licensee costs" of implementing this draft regulatory basis, 

but nowhere is it discussed what the impact would be on the country of a successful attack.

(4-3)

NRC Response: There are no potential licensee costs of implementing the draft regulatory 

basis, because it is not a rule. Such cost information for implementing a new rule will be 

contained in the Regulatory Analysis accompanying both the proposed and final rulemakings.

Comment Summary B-6: Each waste cask should be covered by a protection shield the size 

of an Egyptian pyramid, and be spaced one mile apart from all other casks. This would be a 

Stand Alone Impenetrable Defense (SAIP) strategy in contrast to the Detect, Assess, and 

Communicate (DAC) or Denial of Task (DOT) defense strategies used by NRC licensees. This 

SAIP strategy would seem warranted, given that the NRC has already discovered that nuclear 

plants in three states have insufficient financial reserves to cover their decommissioning. (4-4)

NRC Response: Requiring such large shields, and spacing SNF casks a mile apart, is not 

necessary to provide adequate protection of public health and safety, and would be 

cost-prohibitive. Consequently, the NRC staff finds that the comment’s proposed SAIP strategy 

should not be considered further. 

Comment Summary B-7: The Prairie Island Indian Community (PIIC) believes that any 

revision to the security requirements for ISFSIs must address all homeland security concerns 

and terrorist attack risks (5-3)

NRC Response: Any homeland security concerns and terrorist attack risks deemed to be 

credible and applicable to ISFSIs would be addressed in the proposed rule. But the comment 

provides no description of such concerns and risks, and the staff is therefore unable to respond 

more specifically to this comment. 

Comment Summary B-8: According to the material presented in the January 14, 2010

webinar, it will be up to local law enforcement agencies to detect, assess, and respond to 

threats at ISFSIs. As many of these facilities are located in rural areas, the PIIC questions

whether rural law enforcement agencies will be adequately equipped to respond to heavily 

armed intruders. In addition, will these agencies be supplied with the necessary intelligence in 

order to prepare for an event? Do these agencies have the financial resources to develop 

contingency plans and purchase equipment? The PIIC’s tribal police force has not been

trained to respond to terrorist or radiological events at the Prairie Island Nuclear Generating 

Plant (PINGP), and is not prepared to do so. (5-4)
-14-

NRC Response: The NRC staff had indicated in the Webinar that the ISFSI or MRS licensee is 

responsible for implementing the detect, assess, and communicate (DAC) protective strategy 

(i.e., the licensee’s personnel and equipment detect the security event, the licensee then 

assesses the threat in accordance with its equipment, physical security plan, and contingency 

response plan, and as required contacts the cognizant local law enforcement agency (LLEA) or 

response organization to request assistance). Prior coordination with the responding law 

enforcement agency would be specified in a memorandum of understanding (MOU) between 

the licensee and the LLEA . However, licensee personnel would continue to function in a 

supportive role by communicating with LLEA personnel and facilitating LLEA personnel’s access 

to the ISFSI or MRS. Whether the LLEA personnel responding to the site and executing a 

take-back response are local, State, or Federal law enforcement assets would depend on the 

agreements established by the licensee under this requirement.

In discussions between the NRC staff and the PIIC on these issues, the staff verified that PIIC is

aware that its tribal police are not a response organization for the PINGP or its ISFSI and that 

the tribal police would have no responsibility to defend the site in the event of a terrorist attack 

there.

Comment Summary B-9: The PINGP has a site-specific ISFSI, which will eventually store 98 

dry casks indefinitely. Based on recent events, we have no assurance that the spent fuel from 

the PINGP will ever move beyond the borders of the ISFSI. This is an unreasonable continued 

threat to our community or any community that is the host to an ISFSI. (5-5)

NRC Response: The concerns stated in this comment are outside the scope of the proposed 

rulemaking. The purpose of this proposed rulemaking is to update security requirements for the 

temporary storage of SNF and HLW in an ISFSI or an MRS. Facilities licensed under 10 CFR 

Part 72, are licensed to temporarily store SNF and HLW. Such facilities are not authorized to 

hold these radioactive materials permanently. 

C. Technical Approach

Comment Summary C-1: With regard to the risk-informed, performance-based approach, 

DOE generally supports this approach as appropriate and reasonable. However, DOE has 

learned that even in a risk-informed, performance-based regulatory framework, some 

considerations should be provided by the regulator as prescriptive and deterministic 

requirements, as opposed to being derived by licensees on a risk-informed performance basis. 

An effective risk-informed, performance-based regulation should be accompanied by clear 

guidance and acceptance criteria to licensees informing them of how to include deterministic 

requirements and also demonstrate that they have met the risk-informed, performance-based 

security objectives in their overall assessment. (1-6)

NRC Response: The NRC staff envisions a regulatory framework that will establish consistent 

security requirements across a range of SNF and HLW storage facilities. As shown by the 

NRC’s 2009 final rule on power reactor security – on which this proposed rulemaking will be 

partially based – the staff anticipates that a number of requirements for ISFSIs and MRSs will 

be similarly prescriptive. The risk-informed portion of the proposed approach, relies on dose 

calculations using site specific inputs demonstrating an acceptable outcome at the controlled 

area boundary. Three guidance documents will be published with the proposed and final rule to 

ensure clear guidance and acceptance criteria is available when the rule becomes effective. 
-15-

Comment Summary C-2: Developing a rule specifically to address facilities storing spent 

nuclear fuel, with the objective to codify ISFSI security orders, enhance consistency across 

ISFSIs, and eliminate confusion regarding the various regulatory sections that apply, is a worthy 

undertaking. However, the rulemaking should be informed by the risk to public health and 

safety, the substantial protection naturally provided by these facilities, and the current national 

threat environment.

To arbitrarily impose the same security measures as mandated for operating power plants, and

then subjectively select a set of weapons and tactics to be defended against without basis in the

national threat environment is a flawed approach. This approach would likely result in

misapplication of security measures with potential unintended consequences and result in a

continuing fluid regulatory environment that does not support the Commission's objective of a

stable regulatory process.

ISFSIs should have security measures determined by a design basis that is informed by the 

threat environment and bounded by those measures that should reasonably be expected to be 

employed by public utilities with public security forces, supported by law enforcement, to protect 

these extremely robust structures. Any additional measures deemed necessary due to an 

escalation in the national threat environment should then be the responsibility of the United 

States government.

As noted in Objective Three of the Draft Regulatory Basis, the Commission has previously 

stated:

"Because of this high degree of protection afforded by these massive structures for 

design basis accidents, the NRC has required ISFSI licensees to implement moderate 

security measures and a "detect, assess, and communicate" protective strategy that was 

appropriate to the risk of malevolent acts releasing radiation or radioactive material". 

That statement holds true today and there has been no substantial changes in the threat 

environment that necessitates an escalation in security measures. Therefore, the new rules 

should not mandate additional measures, but simply codify the current appropriate security 

measures required by the ISFSI orders, which were imposed after considerable evaluation by 

NRC. (2-4)

NRC Response: The NRC staff is not seeking to impose additional security measures for 

ISFSIs and MRS in an arbitrary manner. In the years since October 2002 when the ISFSI 

security orders were imposed, the NRC staff has gained insights from ISFSI inspections, 

security studies and force-on-force exercises, all of which indicate that additional measures 

beyond the simple “codification” of ISFSI security orders may become necessary for certain 

licensees who could be affected by this security rulemaking. Accordingly, the staff views the 

draft regulatory basis as not exceeding the DBT for radiological sabotage as applied to power 

reactors.

From a broad perspective, the NRC staff still views the security risk from the spent fuel at a 

power reactor as greater than the spent fuel at an ISFSI or MRS. This is due to the greater 

available mass of SNF at a reactor (i.e., the SNF at the ISFSI is separated into discrete 

quantities in each cask), the decay heat is greater, and the radionuclide inventory is greater 
-16-

(due to the shorter time from shutdown of the reactor). Notwithstanding these differences, the 

NRC staff’s view is that the security risk at the ISFSI increased from the NRC’s long-term

historical view of an essentially zero security risk for dry spent fuel storage systems - due to the 

robust and massive nature of dry SNF storage systems following the attacks of September 11, 

2001. Consequently, the NRC staff’s view is that the proposed new ISFSI security measures 

should be consistent with the threat and vulnerability basis necessary to protect spent fuel from 

radiological sabotage.

Comment Summary C-3: On page 6, the first paragraph, of the regulatory basis contains the 

sentence "These orders ensured that a consistent overall protective strategy is in place for all 

types of ISFSIs, given the current threat environment." Since there has been no substantial 

change to the threat environment, there is no apparent basis for adding additional security 

measures or attempting to solve a problem that doesn't exist. (2-21)

NRC Response: The NRC staff disagrees with the comment. While the threat may not have 

substantially changed since the 2002 security orders were issued the insights gained by the 

NRC since then may warrant the implementation of new security measures. Such additional 

measures, which may need to be made applicable to certain ISFSI licensees, would go beyond 

the simple “codification” of the ISFSI security orders, as stated in the response to Comment C-2.

Comment Summary C-4: Although implementing a new rule that addresses all ISFSIs and 

MRS facilities and reduces the complexities involved in the current regulation is a desirable 

outcome, imposing significant generic requirements without consideration of facility and cask 

design features, as well as the current threat environment, does not appear to be consistent 

with a "risk-informed and performance based structure" (2-24)

NRC Response: The NRC staff agrees in part and disagrees in part. The NRC staff agrees 

that a new rule which addresses all ISFSIs and MRS facilities, and which reduces the existing 

regulatory complexities, would be a desirable outcome. In recommending a dose-based 

approach the draft regulatory basis considers facility and cask design features as well as the 

current threat environment. In doing so, the staff is taking a risk-informed and performancebased approach (as indicated in the response to comment C-1) and thus disagrees with the 

latter half of Comment c-4.

Comment Summary C-5: The NRC is apparently considering developing a separate list of 

adversary characteristics that would apply to ISFSIs. It is unclear why this list should be 

different from the adversary characteristics that define the radiological sabotage DBT for power 

reactors.) (3-2)

NRC Response: For many attributes, the draft ISFSI and MRS adversary characteristics could 

be the same as the power reactor adversary characteristics. However, some technical and 

vulnerability differences exist between power reactors and ISFSIs. A draft ISFSI adversary 

characteristic document (still in draft form) was published for cleared stakeholder comment in 

March 2011.

Comment Summary C-6: The regulatory basis for the proposed performance-based rule does 

not appear to be adequate to support moving to a dose-based criterion at this time. This is 

because there is insufficient experimental data to validate the potential release fractions that 
-17-

could result from sabotage attacks across the entire range of plausible attack modes available 

to adversaries. (3-4)

NRC Response: Beginning in the 1980’s, the NRC and the Department of Energy completed a 

number of classified studies to evaluate the response of SNF dry storage casks to a range of 

malevolent events. The NRC staff intended to use this information in developing guidance 

documents supporting the dose-consequence approach. For some attack methods, a range of 

experimental data exists, e.g., the shock, impulse, and overpressure effects from large bulk 

explosive detonations. For other attack methods, the NRC has obtained data using simulated 

material and analytical calculations. The release fraction values for SNF predicted by analysis 

have shown quite good correlation with the release fraction values determined by experiments 

with simulated material. These results are found Sandia National Laboratories interim final 

report SAND2007-8070.1

 However, experiments using actual SNF (referenced by the

commenter) have not been completed due to funding constraints of other agencies. Based 

upon the current modeling codes and available experimental validation results using simulants, 

the NRC staff considers that sufficient information exists to support reasonably conservative 

calculations of dose consequences for SNF releases due to security events. 

Comment Summary C-7: Because of the inexplicable cancellation by the Department of 

Energy of the spent fuel cask sabotage test program at Sandia National Laboratories several 

years ago, the release fractions resulting from a single shaped-charge attack on a spent fuel 

cask have not been determined experimentally. There has never been a test of the impact of a

shaped charge on a storage cask containing actual spent fuel. Moreover, UCS is unaware of 

tests of more sophisticated attack modes on spent fuel casks that potentially could result in 

greater damage to both the casks and to the contents. UCS understand that the cancelled 

Sandia test program was not planning to study multiple-stage attack modes that could lead to 

increased releases from spent fuel casks, such as penetration of a cask by a shaped charge 

followed with the insertion and detonation of explosives into the cavity. Such attacks would be

plausible under NRC's proposed security scheme, which would not require plant security to 

mount an armed response to deny hands-on access to ISFSIs by adversaries for plants that 

meet the dose-based criterion. (3-5)

NRC Response: The NRC participated in a multi-agency, international, cooperative effort to 

examine the effects of shaped charges against actual spent fuel. As noted by the commenter, 

this study was suspended before its completion, because of funding restrictions. However, as 

discussed in the response to Comment C-6, experiments had been completed through 

validation of the test equipment and obtaining data involving the use of simulants (i.e., the use 

of cerium oxide instead of irradiated uranium dioxide) in standard Zircaloy cladding. The results 

completed to date indicated quite good correlation between the current model’s release fraction 

values and the experimental results (see SAND2007-8070). 

D. Backfit Issues

Comment Summary D-1: NEI agrees with the NRC staff's conclusion that this rulemaking is 

likely to raise backfitting issues under 10 CFR 72.62. NEI commends the staff for explicitly 

identifying potential new requirements in the draft regulatory basis. See SECY-07-0148, at 7; 

 1 SAND2007-8070, “Spent Fuel Sabotage Test Program, Characterization of Aerosol Dispersal: Interim 

Final Report,” January 2008, Martin Molecke, et al; ADAMS Accession No. ML073460184.
-18-

draft regulatory basis, at 14-24. In addition, NEI believes that some of the proposed changes 

relating to general licensees may have backfitting implications under 10 CFR 50.109. NEI 

encourages the staff to perform a robust analysis on all proposed backfits, as adherence to the 

backfit rule is essential in ensuring that staff and licensee resources are properly devoted to 

activities that are necessary for adequate protection, compliance, or to achieve cost-justified, 

substantial increases in overall protection. (2-3)

NRC Response: 

The NRC intends to perform any backfit analysis in compliance with applicable regulatory 

standards. Backfitting issues will be addressed as part of the Regulatory Analysis that 

accompanies the proposed and final rulemakings. However, under the provisions of 10 CFR 

72.13(b) and (c), specific and general Part 72 licensees, respectively, are subject to the 

backfitting provisions of 10 CFR 72.62. Because ISFSIs and MRSs are licensed under Part 72 

and not Part 50, ISFSI and MRS licensees are not subject to the backfit provisions of 

10 CFR 50.109 for matters relating to the ISFSI or MRS, even if the ISFSI or MRS is located 

within the reactor’s protected area (PA). 

As stated in SECY-07-0148, the staff anticipates that this rulemaking is likely to raise backfitting 

issues under 10 CFR 72.62. The staff has not yet performed a backfit analysis for the various 

options under the six policy issues discussed in SECY-07-0148. Informed by the Commission's 

direction on these policy issues, the staff would perform a backfit analysis and cost assessment 

as part of the development of the proposed rule. In the interim, the staff provided a rough 

assessment of potential licensee costs in the Schedule and Impacts section of SECY-07-0148. 

E. Overall Objectives of the Rulemaking 

Comment Summary E-1: Use of the term "current Commission thinking" in the draft regulatory 

basis indicates an approach that is fluid and constantly changing. It is extremely difficult for 

utilities to interpret regulation and design systems and programs in that environment. It is not a 

sound regulatory approach. (2-5)

NRC Response: The NRC staff used the phrase “current Commission thinking” to convey that 

the draft regulatory basis was a staff proposal, and that the Commission’s views on the nature, 

scope, and direction of this security rulemaking were thus not yet finalized and are open to 

public input. An NRC staff objective is to achieve regulatory stability for ISFSI and MRS 

licensees and applicants through the deliberative process of developing proposed regulations 

and regulatory guidance.

Comment Summary E-2: The value of transposing "lessons learned from security inspections 

and Force-on-Force (FOF) evaluations" from power plants to ISFSIs is very limited due to the 

very different nature and operation of these facilities. NRC should be highly selective and have 

a clear basis for why lessons learned from those programs apply to ISFSIs. (2-6)

NRC Response: The NRC staff intends to consider relevant lessons learned from the 

inspection of both operating reactors and ISFSIs due to issuance of security orders since 9/11 

and implementation of the 2009 Part 73 security rule. Lessons learned on issues of 

implementation and interpretation can be applied regardless of type of facility.
-19-

Comment Summary E-3: Mandating identical security requirements to those used in the 

reactor security rule should not be an objective. It would likely result in misapplication of 

technology and implementation of physical security programs that are not necessary for these 

facilities. The value in many cases would not be commensurate with the investment. (2-8)

NRC Response: The NRC staff is considering using relevant security requirements approved 

by the Commission for power reactors (e.g., the 2009 revisions to 10 CFR 73.55) in the ISFSI 

security rulemaking. An example of security requirements that have identical functions at both 

power reactor facilities and at ISFSIs are PA barriers, including fences, delay features, and 

intrusion detection and assessment systems. Rather than creating new language for ISFSI

security, the NRC staff would look to use 2009 rule language approved by the Commission to 

achieve greater regulatory stability across the range of NRC-regulated facilities. This is 

especially important as many ISFSIs are located within a co-located power reactor’s PA; and 

having consistent requirements in these instances is important to reducing regulatory burden. 

F. Using a Risk-Informed and Performance Based Structure

Comment Summary F-1: Objective 3 on pages 2 & 3, states that ISFSIs were evaluated 

against aircraft attack and ground assault scenarios, and that a determination was made that 

"no significant overall facility vulnerabilities were identified and thus no immediate changes in 

the security requirements for ISFSIs were necessary to ensure adequate protection of public 

health and safety." But the draft regulatory basis further states that "certain scenarios

challenged previous NRC conclusions” thus meriting increased security measures.

If the original assessment was valid, what has changed that requires additional measures "to

ensure adequate protection of public health and safety"? Either the threat environment has

changed (for which there is no evidence provided) or the licensees will be required to implement

security measures for "less than significant" vulnerabilities. The draft regulatory basis document 

provides no sound basis for an increase in security measures beyond those implemented in 

response to the ISFSI Orders. (2-10)

NRC Response: The terrorist attacks of September 11, 2001, led to the NRC’s issuance of 

security orders to ISFSI licensees in October 2002. The NRC then performed security 

assessments of ISFSIs during 2003 to 2005 to evaluate if the NRC needed to take immediate 

additional actions above and beyond the security orders to ensure that public health and safety 

and the common defense and security were adequately protected. These ISFSI assessments 

were part of a larger set of assessments taken across a range of NRC-licensed facilities, all of 

which used a common “framework methodology” to evaluate the need for additional action 

based upon potential numbers of prompt fatalities. These 2003 to 2005 assessments did not 

show a need to take immediate action.

However, the ISFSI security assessments indicated that the radiological consequences for 

certain scenarios could reach dose levels that exceeded NRC’s current regulatory standard in 

10 CFR Part 72 of a 0.05 Sv (5-rem) dose at the controlled area boundary. The Commission 

accordingly directed the NRC staff to evaluate the need for regulatory changes to ISFSI security 

requirements in SRM-SECY 05-0058. This SRM led to the development of SECY-07-0148, in 

which the NRC staff found “that certain security scenarios may challenge the 0.05-Sv (5-rem) 

dose limit” (encl 2, page 4)and merit increased security measures."
-20-

Comment Summary F-2: The statement in the draft regulatory basis that "new information" 

obtained during the assessments from 2003 to 2005 now justify increased security measures 

several years later, is not a valid basis. (2-12)

NRC Response: The NRC staff disagrees. See response to Comment Summary F-1. 

Comment Summary F-3: NRC evaluated security measures at ISFSIs from 2003 to 2005 and 

determined there was no "significant vulnerability" and imposed "moderate security measures" 

based on the risk to these facilities. To now state that those same studies "challenged previous 

NRC conclusions" and "indicated that increased security requirements were warranted" as a 

basis for a new rule that mandates significant changes is either a flawed conclusion, or calls 

into question the validity of the assessments. The NRC determined appropriate security 

measures based on the assessments and issued ISFSI Orders mandating those measures. 

Since there have been no significant new assessments or substantial changes to the threat 

environment, the new rule should simply codify existing requirements. The proposed changes 

should not be determined by subjective views of potential risk. (2-25)

NRC Response: The comment misrepresents the conclusions of the 2003-2005 security 

assessments. The ISFSI security measures were imposed in 2002 and were not a result of the 

security/vulnerability assessments which occurred from 2003-2005. The security assessments 

were not an evaluation of the imposed security measures. After reviewing the studies, the staff 

concluded and the Commission agreed no immediate changes were necessary and any future 

changes would be handled through rulemaking. The issue of threat is addressed in the 

response to Comment Summary A-3. See also the response to Comment Summary F-1.

Comment Summary F-4 :

The terms "site boundary" and "controlled area boundary" are both used in apparent reference 

to the same boundary. Since "controlled area boundary" is used throughout the draft regulatory 

basis, the term "site boundary" should be changed. The draft regulatory basis lacks any 

discussion of the access control measures or occupancy restrictions that may apply within a 

licensee’s controlled area boundary. The controlled area boundary at many sites, especially 

those with facilities within a power reactor’s PA, would encompass normally occupied 

structures. Many of the structures are occupied 24 hours per day. The NRC should consider its 

proposed approach in light of potentially high occupancy within the controlled area boundary. If 

the proposed approach is adopted, this aspect must be addressed. (2-26)

NRC Response While Comment Summary F4 correctly notes that the terms “site boundary” 

and “controlled are a boundary” are both used in the draft regulatory basis, the NRC staff does 

not agree that these terms refer to the same boundary. The intended meaning of these terms, 

as used in the draft regulatory basis, is discussed below.

The term “site boundary,” as used in the draft regulatory basis, has the same meaning as the 

term is defined in 10 CFR 20.1003 (“that line beyond which the land or property is not owned, 

leased, or otherwise controlled by the licensee”). As stated in 10 CFR 20.1002, the scope of 

part 20 is broad, and its requirements and terms apply to all part 50 and part 72 licensees. 

While the term “controlled area boundary” is not a defined term, “Controlled area” is defined in 

10 CFR 72.3 as meaning “that area immediately surrounding an ISFSI or MRS for which the 
-21-

licensee exercises authority over its use and within which ISFSI or MRS operations are 

performed,” and the phrase “nearest boundary of the controlled area” is used in 10 CFR 

72.106(b). Pursuant to 10 CFR 72.106(c), a controlled area can be traversed by a public road, 

railway, or water way, provided that “appropriate and effective arrangements are made to 

control traffic and to protect public health and safety.” 

Comment Summary F-5: Using a subjective decision making process to select a set of 

weapons and tactics, which the draft regulatory basis document states on page 3 and 4, are 

based on "vulnerability information that is not threat based" and "for which an underlying threat 

stream does not currently support their inclusion under the DBT", is an inappropriate 

methodology to determine regulatory requirements. It also is in conflict with the Commission's 

direction to NRC staff in SRM_SECY 07-0148 to ensure that "new performance-based security 

requirements" "do not impose a new Design Basis Threat (DBT)" and that ISFSI regulatory 

guidance "would be bounded by the adversary characteristics regulatory guidance supporting 

the Design basis Threat (DBT) for radiological sabotage associated with power reactors". (2-14)

NRC Response: Adversary characteristics are subjective, in that they are based on threat 

information developed by the intelligence community, and on vulnerability information evaluated 

by security experts from the NRC and national laboratories. Although they are subjective, they 

are based on the DBT for Radiological Sabotage as applied to power reactors and Regulatory 

Guide RG 5.69 (power reactor adversary characteristics). 

Comment Summary F-6: In accordance with the Commission's direction to staff in 

SRM-SECY 07-0148 that "new performance-based security requirements" "do not impose a 

new Design Basis Threat (DBT)" and that ISFSI regulatory guidance "would be bounded by the 

adversary characteristics regulatory guidance supporting the DBT for radiological sabotage 

associated with power reactors", it seems that the statement on page 4 of the draft regulatory

basis document that says "...the NRC would discontinue the application of the DBT for 

radiological sabotage to general license ISFSIs" is in conflict and the proposed approach does 

not appear to reflect Commission direction. (2-20)

NRC Response: The staff disagrees. SRM-SECY 07-0148 approved the proposed use of a 

dose-based approach for all ISFSI licensees. The proposed dose-based approach would 

replace use of the existing DBT approach. 

Comment Summary F-7: This sentence on page 4, second paragraph is somewhat 

misleading, particularly for existing ISFSI facilities. In the proposed approach (this proposed 

regulatory structure affords current ISFSI licensees and any future ISFSI or MRS licensees with 

the greatest amount of flexibility in meeting the regulations), if the licensee doesn't have the 

footprint to establish a larger CAB (controlled area boundary) to support the 5 Rem limit, they 

would be required to either make major modifications to the facility (in most cases not feasible) 

or implement a denial strategy. There is very little "flexibility" provided. (2-15)

NRC Response: The NRC staff recognizes that under the proposed approach, the degree of 

flexibility for some licensees could be significantly less than for other licensees. 

Comment Summary F-8: NRC has likely underestimated the number of facilities that would 

unnecessarily be required to implement a denial strategy. Since those facilities would be 
-22-

required to implement a drill and exercise program and could possibly be subjected to FOF 

inspections, the fees to licensees and impact on NRC staff resources would likely be significant. 

(2-16)

NRC Response: The NRC staff agrees that in the draft regulatory basis it has likely 

underestimated the number of facilities that would have to implement a denial protective 

strategy under the proposed rulemaking. The estimated number of affected facilities will be 

factored into the draft Regulatory Analysis that will support the proposed rule, consistent with 

the rulemaking approach to be chosen by the Commission.

Comment Summary F-9: The statements on page 4, 3rd paragraph of the regulatory basis,

clearly indicate the potentially severe financial impact of the approach discussed in the draft 

regulatory basis, and its lack of any appropriately corresponding benefit in protection of public 

health and safety. Moving spent fuel to another facility would undoubtedly require significant 

expansion of that facility to new standards driven by this proposed regulation. The cost of 

expanding facilities and transporting fuel would be enormous. Changing from the currently 

implemented security measures to this approach should not be proposed without fully

understanding the potential impact and its relation to increased public health and safety in the

current threat environment. (2-19)

NRC Response: With regard to moving spent fuel to another facility, the NRC staff was 

identifying that as a potential option for licensees to consider in evaluating the costs of 

implementing a proposed rulemaking, especially if the licensee is constrained by dose results 

and the site footprint. 

Comment Summary F-10: The basis for the 3rd and 4th sentences, 2d paragraph, page 4 needs 

explanation. Since the fuel loading (including burn-up time), as well as facility construction, are 

major considerations in determining the CAB location and strategy, this approach does not 

appear to be "independent of future fuel loading characteristics and dry-cask storage designs". 

It appears that additional calculations would be necessary for future fuel loads to ensure the 

CAB dose limit would not be exceeded if a canister was breached. This approach would require 

development of a significant amount of additional safeguards information that actually increases 

the risk of unauthorized disclosure instead of reducing it, simply due to the increased volume. 

(2-17)

NRC Response: The NRC staff agrees that a dose-based approach is subject to periodic 

reevaluation if the licensee changes the fuel burn-up and cooling time mix because a different 

radionuclide mixture can result in different dose consequences. Alternatively, a licensee could 

use conservative values in performing its initial dose calculations, to reduce the need for further 

calculations. The NRC staff also agrees that the dose calculation approach may result in the 

creation of additional safeguards information. However, the NRC staff does not agree that this 

increased volume of information increases the risk of unauthorized disclosure. Rather, the NRC 

staff’s view is that licensees can reasonably provide necessary security measures for all of the 

safeguards information they possess or may later develop.

G. Impacts of Using a Denial Protective Strategy

Comment Summary G-1 :
-23-

Requiring power reactor licensees having ISFSIs located within the PA to submit their security 

plans -- both for protecting the reactor and the ISFSI -- to the NRC for prior review and approval 

would impose a significant and unnecessary burden on such licensees and on the NRC staff. 

Licensees electing to incorporate their ISFSIs into a denial strategy that is being used for the

reactor should have the ability to (1) make modifications to the reactor strategy, (2) make 

findings that there is no reduction in physical security effectiveness, and (3) submit such 

findings to the NRC under the existing 10 CFR 50.54(p) process. Such submittals would be 

subject to follow-up inspection by the NRC. (2-23)

NRC Response: 

The regulatory issues to be evaluated during the proposed rulemaking are not whether there 

has been a decrease in the effectiveness of the reactor’s security program. Rather, the focus 

will be on what requirements should be made applicable to ISFSI and MRS security programs to 

ensure adequate protection of public health and safety. For a co-located ISFSI, these are two 

separate, but related questions. Therefore, the NRC staff continues to view prior review and 

approval of security plans implementing a denial protective strategy as appropriate. As 

discussed in the related responses in A5, the NRC’s view is that a reactor licensee’s shift to a 

denial protective strategy for its ISFSI – in cases where this step is necessary to meet the 5-

Rem security dose limit that the NRC plans to add to part 73 – will require the NRC’s prior 

review and approval. Such approval will be necessary to ensure that the licensee’s physical 

protection program continues to provide high assurance that the common defense and security, 

and public health and safety, are adequately protected in accordance with 10 CFR 73.55(b)(1). 

The requirements of 10 CFR 50.54(p) cover any changes made to the following security plans: 

“guard training and qualification plan”; “cyber security plan”; “physical security plan”; and 

“safeguards contingency plan.” Except for cyber security, the scope of the parallel 10 CFR 

72.186 security plan change requirements applicable to specific ISFSI licenses is the same.

Comment Summary G-2: The proposed change to a dose-based approach would allow power 

reactor licensees to continue siting ISFSIs outside of the [reactor’s] PA boundary, where 

capabilities for detection and assessment of adversaries and rapid armed response are below 

those within the PA. And it would permanently exempt ISFSI protection from force-on-force 

exercise and inspection requirements except on a case-by-case basis for licensees who need to 

utilize a "denial of task" protective strategy because they cannot otherwise meet the proposed 

dose-based requirement. The impact of this change overall would likely reduce the level of 

protection of all current and future ISFSIs and increase the threat to public health and safety.

(3-3)

NRC Response: The staff disagrees with the comment because it provides no basis to support 

making force-on-force exercise and inspection requirements applicable to ISFSIs. Such 

requirements have never applied to ISFSIs, and the statement that the proposed rule would 

“permanently exempt” ISFSIs is therefore not accurate. Other force-on-force issues are 

discussed in Section P below.

H. General Security Requirements

Comment Summary H-1: As written on page 14 paragraph 3, the last sentence implies that an 

evaluation of the effects of a vehicle bomb attack would only be necessary if no vehicle barriers 
-24-

are installed to protect the pathway. In reality the evaluation would need to be performed to 

determine if vehicle barriers are necessary, and if so, their location. Previously a specific blast 

analysis was not required if the VBS was located at a minimum specified distance from the 

ISFSI components and/or structures being protected against a bulk explosive attack. If this 

approach is adopted; a similar criteria [to that specified for reactors] should be established [for 

ISFSIs and MRSs]. (2-28 and 2-29)

NRC Response: The NRC staff agrees that under the draft regulatory basis licensees would

be required to complete blast analyses to support the placement of permanent vehicle barrier 

systems. During the proposed rulemaking, the NRC staff will consult with the U.S. 

government’s blast experts at the U.S. Army Corps of Engineers’, Protective Design Center

(USACE/PDC) on whether a generic standoff distance can be established for large bulk 

explosive attack (delivered by vehicle) against ISFSIs, that does not require completion of a 

site-specific ISFSI blast analysis. 

Comment Summary H-2: The wording in the section that starts on page 14 and continues on 

page 15, specifically mentions "fitness for duty programs." We are concerned that this may infer 

that a 10 CFR Part 26 Fitness for Duty (FFD) Program may become required. Due to the small 

staff sizes at many ISFSIs and the acceptability of the current ISFSI access authorization 

program imposed by NRC Orders, the proposed rule should not require a Part 26 Fitness for 

Duty Program. (2-32)

NRC Response: The NRC does not plan to address in this proposed security rulemaking 

whether Part 26 requirements should be applied to ISFSIs, especially stand-alone ISFSIs. 

However, the NRC staff is evaluating in a separate rulemaking effort whether to apply Part 26 

FFD program requirements to a range of fuel cycle and waste facilities that could include ISFSIs 

and MRSs.

Comment Summary H-3: The 2d full paragraph on page 15, indicates informality in 

accumulating information on which to base regulatory requirements that is inappropriate for the 

rulemaking process. Some of the cited examples have no clear nexus with ISFSIs. This 

paragraph also introduces an extensive list of "security performance capabilities and functions" 

that basically applies security measures for power reactors, in total, to ISFSIs. To arbitrarily 

impose the same security measures as mandated for operating power plants could potentially 

result in misapplication of security measures and resources with unintended consequences. 

Misdirection of limited resources is wasteful and could result in a reduction in overall 

effectiveness by inappropriately shifting focus without commensurate value added to protection 

of public health and safety. No additional security measures should be required for ISFSIs 

without careful evaluation of applicability to the current threat environment and value added. (2-

34) (2-33)

NRC Response: The NRC uses a variety of information gathering techniques in evaluating the 

need for changes to regulations. Using lessons learned from previous rulemakings and 

inspections are valuable even if the rulemaking or inspection had no nexus to an ISFSI. The 

degree of formality varies with the source and nature of the information suggesting a change is 

needed to regulatory requirements. 

In developing the draft regulatory basis document, the NRC staff considered the following 

factors: 1. The spent fuel in a power reactor’s spent fuel pool (that is older than 5 years) is 
-25-

essentially identical to the spent fuel stored in an ISFSI, especially when considering the fuel’s

chemical, mechanical, thermodynamic, nuclear, and radioactivity properties. 2. Many security 

subsystems and functions are essentially identical for power reactors and ISFSIs, e.g., PA

barriers, intrusion detection and assessment systems, communication and alarm systems, 

lighting systems, contraband detection systems and search requirements, and central alarm 

station functions. 3. At a dry-storage ISFSI, the total mass of spent fuel available to be 

attacked in a single assault is less than the quantity of spent fuel that can be stored in a spent 

fuel pool. 4. Dry spent fuel storage systems are more robust, passive, and massive, per unit of 

spent fuel, than reactor spent fuel storage systems. NRC staff considered these factors, and 

the results of ISFSI security assessments and the current threat environment, in developing the 

draft regulatory basis. Accordingly, the NRC staff disagrees with the comment that it seeks to 

arbitrarily impose on the ISFSIs security measures that would not add to the protection of public 

health and safety.

I. Vulnerability Driven Physical Protection Program

Comment Summary I-1: The "Vulnerability Driven Physical Protection Program"' as currently 

described in the draft regulatory basis is an approach with significant flaws. It should be 

abandoned in favor of codifying currently employed security measures mandated by ISFSI 

orders. (2-35)

NRC Response: The NRC staff has not committed to a single approach but is still reviewing all 

options. The NRC staff agrees that improvements can be made to the draft regulatory basis

and is working closely with industry and other cleared stakeholders to improve this rulemaking 

effort. However, the NRC staff does not agree with the comments that the scope of this 

rulemaking should essentially be a “codification” of the ISFSI security orders issued by the NRC 

in 2002.

Comment Summary I-2: Consistent with the PSP for power reactors, the specific information 

on law enforcement response capabilities should reside in a law enforcement response plan 

located in facility procedures, and should be subject to similar reviews and controls. (2-36)

NRC Response: The NRC staff agrees although location and review of such plans was not 

discussed in the draft regulatory basis. The NRC staff will consider addressing these issues in 

the proposed rule.

J. Vehicle Barrier System

Comment Summary J-1: The specifications for land-based vehicle bombs and waterborne 

vehicle bombs should be consistent with those for power reactors. (2-38)

NRC Response: The NRC staff agrees although the These specifications were not addressed 

in the regulatory basis. The NRC staff will consider addressing these issues in the proposed 

rule.

Comment Summary J-2: Page 18 (7), second paragraph, of the draft regulatory basis, the 

words "any other equipment necessary for the safety and security of the ISFSI or MRS facility" 

are too broad and should be "as identified in the facility PSP". (2-39)
-26-

NRC Response: The NRC staff agrees.

Comment Summary J-3: Meeting ASTM Standard F2656-07 should not be the only means to 

determine acceptability of the VBS [vehicle barrier system]. Any generally accepted 

engineering methodology to calculate penetration resistance should be acceptable. (2-40)

NRC Response: The National Technology Transfer and Advancement Act of 1995 (Pub. L. 

104-113) requires that federal agencies, when developing regulations, use technical standards 

that are developed or adopted by voluntary consensus standards bodies, [when developing 

regulations], unless using such standards is inconsistent with applicable law or is otherwise 

impractical. In the proposed rulemaking, the NRC staff plans to use ASTM Standard F2656-07 

as a consensus technical standard, because it is relevant to developing an acceptable VBS. 

The NRC staff is also planning proposing to use “alternate measures” regulatory language 

similar to that used in 10 CFR 73.55(r). Licensees would thus have the flexibility to perform 

their own engineering calculations to demonstrate that their proposed VBS achieves the 

required security performance objectives. However, additional staff review effort would likely be 

required when licensees perform their own engineering calculations. (See also Comment 

Summary H-1 response.)

Comment Summary J-4: The NRC is a regulatory body and is supposed to issue specific 

regulations. ASTM has never come up with a standard for a nuclear waste cask resisting attack 

by an EFP [explosively formed projectile] or IED [improvised explosive device], or for a spent 

fuel pool resisting an aerial attack. (4-5)

NRC Response: The ASTM standard F2656-07 the NRC staff is planning to use in the 

rulemaking is for vehicle barrier systems that are used to protect against bulk vehicle bombs, 

either land based or waterborne. With respect to aircraft attacks on SNF storage pools, such 

attacks are not within the draft adversary characteristics proposed for ISFSI and MRS licensees. 

Moreover, the only pool-type ISFSI licensed under 10 CFR Part 72 has a below grade pool. 

Such a pool could not be drained by an aircraft attack.

K. Physical Barrier Systems

Comment Summary K-1: Section 8, Physical Barrier Systems on page 18 needs to be clarified 

to state the requirements for the two barriers for the PA where the spent fuel is stored and the 

barrier requirements for the central alarm station PA. With respect to illumination of the first PA 

barrier, it should be clarified that a specific foot candle value will not be required as long as 

there is enough illumination for "adequate assessment and observation." (2-41)

NRC Response: In the proposed rulemaking, the NRC staff plans to consider whether ISFSIs 

should be located within both vital and PA barriers, or whether storage of SNF and HLW within 

only a PA barrier remains sufficient. In the NRC’s final rule which established the general 

license provisions of 10 CFR Part 72 (55 FR 29181; July 18, 1980), the Commission addressed 

the issue of whether a cask wall could be considered as a physical barrier (see comment 41 at

page 29189). However, in the Commission’s 2009 rule on power reactor security, the NRC 

specified in 10 CFR 73.55(e)(9)(v)(B) that the power reactor spent fuel pool must be considered

as, or located within, a vital area. Accordingly, the NRC staff will evaluate whether a basis

exists for requiring SNF at a wet ISFSI to be located in a PA, while requiring SNF at a power 

reactor SNF pool to be located in a vital area. A separate question to be evaluated is whether 
-27-

10 CFR 73.55(e)(9) vital area requirements for SNF stored in a reactor spent fuel pool should 

also be applied to SNF stored in a dry storage cask .

With respect to illumination level requirements, the NRC staff views the 10 CFR 73.55(i)(6)

illumination requirements as an appropriate starting point for the proposed ISFSI and MRS 

security regulations. Illumination could be provided by visible or non-visible illumination 

systems; or alternatively, licensees could use low-light technology to accomplish the 

performance objective.

L. Access Points and Search Equipment

Comment Summary L-1: Imposing additional search requirements above those already 

employed are unnecessary to provide assurance that unauthorized access to spent fuel

containers is prevented. In particular, adding a requirement for explosive detectors and metal 

detectors provides very little additional value in preventing the introduction of materials that 

could damage the facility or its canisters. A physical pat-down search by trained and qualified 

security personnel is adequate. (2-44)

NRC Response: The comment regarding proper search requirements is predicated upon the 

spent fuel being located in massive, sealed, dry storage containers, which have minimal 

susceptibility to the handheld devices or contraband that would be detected by explosive and 

metal detectors. For ISFSIs or MRSs that use such containers, the NRC staff agrees that a 

physical pat-down search of individuals by trained and qualified security personnel would be

adequate. However, a range of SNF and HLW storage facilities exist today (and could exist in 

the future) that use different types of containers. For some of these facilities (e.g., an ISFSI with 

an active wet cooling system, or an ISFSI or MRS with a dry transfer system), explosive 

detectors and metal detectors provide additional value in preventing the introduction of materials 

that could damage the facility or its canisters. The NRC staff will address this issue further in 

developing the proposed rule.

M. Alarm Station Capabilities

Comment Summary M-1: Consistent with 10 CFR 73.55, alarm stations should only be 

required to be "redundant and independent" if they are newly constructed. The functional 

equivalency requirements for current alarm stations should be maintained. (2-45)

NRC Response: Although this issue is not discussed in the draft regulatory basis, the NRC staff 

will consider addressing it in the proposed rule.

N. Independent Power Systems

Comment Summary N-1: On page 20, the reference to 10 CFR 73.55(i)(5) in section 14, 

Independent Power Systems appears to be incorrect. (2-46)

NRC Response: The NRC staff agrees. The reference should have been to 10 CFR

73.55(j)(5).
-28-

Comment Summary N-2: Requiring multiple power sources for ISFSIs security systems is

unnecessary. Response protocols and compensatory measures for loss of power are sufficient 

to identify hostile intent and initiate additional response, if necessary. (2-47)

NRC Response: The NRC staff agrees, in part. If a licensee is only required to implement a 

detect, assess, and communicate protective strategy, then multiple or independent power 

sources for security systems would not be necessary. However, if a licensee is required to 

implement a denial protective strategy, then multiple or independent power sources would be 

necessary for security functions that include communications, command, and control functions 

(i.e., directing contingency response personnel to interpose themselves between the 

adversaries and target sets and to then interdict and neutralize the adversaries).

O. Single Node Failures

Comment Summary O-1: The term "single node," as used on page 21, section 15 of the draft 

regulatory basis, is a new term of art and it needs to be defined. For example, could a whole 

building containing the central alarm station and back-up power supplies constitute a "single 

node" since the structure and equipment could be damaged/destroyed during an earthquake or 

natural phenomena event? (2-48)

NRC Response: The intended meaning of the term “single node failure” is that a licensee 

would be required to ensure the operability of those structures, equipment and systems 

necessary for the security of the facility, and that such items would not be permanently 

disrupted by the destruction of, or damage to, a single component caused by a security threat. 

In the proposed rulemaking, the NRC staff plans to evaluate the need to apply single node 

failure requirements to ISFSI and MRS security systems (e.g., alarm, detection, and 

assessment) and alarm stations.

Comment Summary O-2: Why is "natural phenomena" included in this single node 

requirement? This could conceivably require certain structures containing security equipment 

and the equipment itself to be designed to meet a specific seismic standard in order to remain 

operable. The words "or natural phenomena" should be deleted from section 15 on page 21.

(2-48)

NRC Response: As indicated in the response to Comment Summary O-1 above, in the 

proposed rule the NRC staff plans to develop requirements that adequately ensure equipment 

operability. The staff plans to consider in the proposed rule the use of back-up systems and 

mitigating measures following the destruction of equipment. At this time, the staff does not plan 

to include in the proposed security rulemaking any safety requirements related to natural 

phenomena.

Comment Summary O-3: Section 15, page 21 would impose requirements that exceed those 

for power reactors, and as written, the requirement could be applied to nearly any security 

equipment employed. This proposed requirement is unnecessary for this type of facility. 

Response protocols for security system(s) interruption are sufficient to identify hostile intent and 

initiate additional response, if necessary. (2-49)

NRC Response: The draft regulatory basis is not a proposed rule and thus contains no 

proposed requirements; rather it is a summary of the staff’s current thinking. As discussed in 
-29-

the responses to Comment Summaries N-2, O-1, and O-2, the NRC staff is not planning to 

develop ISFSI and MRS security requirements which exceed those applicable to power reactor 

licensees. The protection of SNF from radiological sabotage at power reactors, ISFSIs, and 

MRSs is considered an equivalent task in terms of acceptable outcomes. However, the method 

of accomplishment may differ. The basis for the NRC staff's proposed protective strategy for 

ISFSI and MRS licensees is dependent upon the current threat environment, and SNF and HLW 

storage system vulnerabilities. The threat and vulnerability information underlying this ISFSI 

and MRS regulatory basis is sensitive security information and has been discussed with 

stakeholders in July 2011 and again in March 2013. Such information cannot be discussed 

further in this public document.

P. Force on Force Evaluations

Comment Summary P-1: NRC is correct that the value of FOF exercises for ISFSIs and MRSs 

does not outweigh the associated costs and risks of such exercises as stated in Section 16, 

page 21. The same holds true for licensee performance evaluations in a FOF style exercise. 

Response protocols for ISFSIs can be adequately evaluated through other means such as table 

top drills, limited scope drills, law enforcement liaison, etc. (2-50a) 

NRC Response: The NRC staff’s view is that FOF exercises and licensee evaluations do not 

provide significant benefit for ISFSI and MRS licensees implementing a detect, asses, and 

communicate protective strategy, and that any benefit is outweighed by the costs of an FOF 

program. The likelihood of such licensees achieving a successful outcome to an attack –

notifying local law enforcement to respond – is high. In contrast, assessing the performance of 

a licensee’s integrated security program implementing a denial protective strategy is a much 

more complex task, for which an FOF requirement may be warranted. This FOF issue will be 

considered further in the proposed rulemaking.

Comment Summary P-2: Section 16 states that NRC is not considering NRC evaluated FOF 

exercises seems to be in conflict with the last sentence of the first paragraph on page 10 of the 

regulatory basis that states, "However, if an ISFSI licensee revises its security program to 

employ a "denial of task" protective strategy, then the NRC staff would reevaluate the need for a 

FOF exercise against that ISFSI on a case-by-case basis." (2-50b)

NRC Response: As indicated in the response to Comment Summary P-1, the referenced 

statements are not in conflict. Further, under section 170D of the AEA (42 U.S.C. § 2210d) the 

NRC must determine if FOF evaluations are appropriate for licensees with private guard forces 

that are defending against a design basis threat (DBT). Such licensee actions could be required

if an ISFSI was required to initiate a “denial of task” protective strategy. 

Q. Alternative Measures

Comment Summary Q-1: Will the NRC continue to honor their previous approval of a 

licensee's Alternative Measures or will licensees need to resubmit their Alternative Measures for 

NRC's review and approval again after the final rule is issued? For example, the NRC has 

previously approved use of alternative measures instead of a VBS for protection of primary and 

secondary alarm stations and some other equipment necessary for the safety and security of 

the ISFSI facility. 
-30-

NRC Response: In the past, it has not been the NRC’s practice to require a licensee to rejustify its use of alternate measures following a change in regulations. However, the proposed

rulemaking is expected to make major revisions to the ISFSI and MRS security regulations. 

Therefore, during the proposed rulemaking stage, the NRC staff plans to evaluate whether with 

respect to alternate measures, their imposition on existing ISFSI licensees would constitute 

backfits under 10 CFR 72.62 Related backfit issues are discussed in Section D above.

Comment Summary Q-2: This [proposed alternate measures requirement] is not an entirely 

new requirement because 10 CFR 73.51(b)(2) currently contains provisions for licensees to 

propose and the NRC to approve specific alternative measures, also the criteria within this 

document is more stringent than the words in Section 73.51(b)(2). (2-51b) 

NRC Response: The comments reference to 10 CFR 73.51(b)(2) are incorrect. The regulatory 

provisions in 10 CFR 73.51(d) allow the use of alternate measures and, the staff has no plans to 

change this requirement.

R. Security Program Reviews

Comment Summary R-1: In response to paragraph 23, the current 10 CFR 73.55(m) was 

reviewed and Section 73.55(m)(1) states, in part:

"As a minimum the licensee shall review each element of the physical protection program at 

least every 24 months. Reviews shall be conducted: (i) Within 12 months following initial 

implementation of the physical protection program or a change to personnel, procedures, 

equipment, or facilities that potentially could adversely affect security. ..." Note that the above 

words "that potentially could adversely affect security" are very different and more conservative 

than the 10 CFR 72.186 wording "decrease the safeguards effectiveness" that is used to 

determine if prior NRC approval is needed for a proposed change. If this was made applicable 

to ISFSIs and MRSs, it is not clear how the above requirements would be implemented. Who 

would make the judgment that a change to personnel, procedures, equipment, or facilities that 

potentially could adversely affect security? (2-52)

NRC Response: The NRC staff plans to use the language in 10 CFR 73.55 as a template for 

the proposed ISFSI and MRS security requirements, as applicable. Power reactor licensees are 

implementing the 10 CFR 73.55(m) security program requirements and almost all ISFSIs are 

co-located with a power reactor. 10 CFR 73.55(m) allows reactor licensees to make the 

judgment on whether a change has adversely affected security. Therefore, the NRC staff 

anticipates that all ISFSI and MRS licensees will be made subject to a similar regulatory 

standard. During the ISFSI and MRS security rulemaking, the NRC staff will evaluate if existing 

regulatory guidance on program reviews is adequate, or if further clarification or changes are 

necessary for ISFSI and MRS licensees.

S. Key Facility Security and Emergency Response Information

Comment Summary S-1: An ISFSI facility site boundary may have many different distances to 

the site boundary depending on the owner's property boundaries. Does the NRC want the 

distance from the nearest facility site boundary to the closest SNF or HLW storage cask (which 

would change as more casks were moved to the pad) or edge of the storage pad? (2-53)
-31-

NRC Response: As indicated in the response to Comment Summary F4 above, the NRC may 

need to develop, during the rulemaking process, criteria for defining a "site boundary" for 

ISFSIs. For example, the distance between a SNF or HLW storage cask and the ISFSI site 

boundary, could be reported to the nearest 10 meters. Or changes in the reported distance due 

to adding additional SNF or HLW storage casks to the storage pad could be required if the 

distance as measured from the edge of the storage pad changed by more than 50 meters. 

Such approaches would minimize the number of potential licensee updates, thus reducing 

unnecessary burden while still ensuring that adequate information in the NRC’s emergency 

response Operations Center is maintained.

Comment Summary S-2: Section 26 of this [draft regulatory basis] document proposes 

effective dates and compliance dates. NRC recognizes under this proposed approach that 

"implementing these new provisions is not simple" and proposes "one (1) year from the effective 

date of the final rule to complete required analyses, design and develop necessary solutions, 

and if necessary submit any revised security plans to the NRC" and then have an additional six 

(6) months for implementation to achieve full compliance. Therefore, requiring licensees to 

submit some of the requested information (e.g., distance from the storage facility to the 

controlled area boundary) within 90 days of the effective date of the final rule would not permit 

the analysis and design necessary to provide accurate information. In addition, requiring annual 

submittals is unnecessary, since any changes to the facility that changed the types of 

information requested would necessitate submittal of a security plan revision to NRC. (2-54)

NRC Response: The NRC staff recognizes that implementing the new security and emergency 

response measures under this rulemaking could affect information the NRC staff was 

considering collecting, such as the distance from the storage facility to the controlled area 

boundary. Regarding periodic updates, the NRC staff needs to ensure that information in its 

records is accurate, but is collected without imposing an undue burden on licensees. Given that 

licensees have periodically expanded the size of their ISFSI, or made other changes to physical 

parameters, the NRC staff’s view is that some periodic review and updating of this information is 

necessary. Whether event trigger updating or periodic updating is warranted, and how often 

information must be submitted, are issues that will be evaluated in the proposed rulemaking. 

T. Armed Security Officers and Armed Responders

Comment Summary T-1: The proposed requirement that, the two armed ISFSI security 

guards may not also serve as armed responders for the power reactor facility’s security plan 

(i.e., security personnel may not be double counted (credited as able to respond) in physically 

separated facilities).), should only apply to collocated facilities that are outside the Protected 

Area of the power reactor. For collocated facilities inside the power reactor’s PA, joint response

functions may be totally appropriate based on the [ISFSI] facility’s design and the protective 

strategy employed. (2-55)

NRC Response: The NRC staff agrees, in part. Under a detect, assess, communicate 

protective strategy, once an intrusion has been communicated it may be possible for an armed 

security guard to participate as part of the reactor response force. The availability of armed 

responders would be dependent upon the ISFSI’s protective strategy. But as stated previously, 

statements in the draft technical basis should not be characterized as “proposed requirements.” 
-32-

Comment Summary T-2: The insertion of the term "interdict and neutralize" sets a standard 

that is not appropriate for facilities that employ a "detect, assess, and communicate" protective 

strategy. (2-56)

NRC Response: The NRC staff agrees that the terms “interdict, interpose, and neutralize” (in 

reference to the duties of the licensee’s armed security personnel) are not appropriate for a

licensee implementing a "detect, assess, and communicate" protective strategy. However, 

these terms would be appropriate if ISFSI and MRS licensees are later required to implement a 

“denial” protective strategy. These issues will be evaluated in the proposed rulemaking. 

U. Proposed Dose Criterion Standard 

Comment Summary U-1 : In the SRM dated 12/18/2007, the Commission stated as follows: 

"The Commission has approved the staff’s recommendation to keep the dose limit for 

radiological sabotage consistent with the dose limit for ISFSI Design Basis Accidents (DBAs) 

(i.e., a 0.05-Sv (5-Rem) dose limit at the controlled area boundary. The Commission has 

disapproved the staff's recommendation to meet a 0.01-Sv (1-Rem) dose limit for both safety 

and security events at the site area boundary." 

The facility's "site boundary" is different than the "Controlled Area Boundary." Why is a dose 

calculation required at the facility's site boundary? Many ISFSIs have a "site boundary" that is a 

shorter distance than the distance to the "Controlled Area Boundary." (2-11)

Comment Summary U-2 : NEI is opposed to the use of a dose-based standard, but states that 

if such a standard is used, a higher value (i.e., greater than 5 rem) should be used for securitybased events. The existing 5 rem standard for safety-based events should not be used for 

security-based events (2a-2)

Comment Summary U-3 : Deliberate acts of sabotage should not be included within the 

description of "design basis accident." Deliberate acts are not forces of nature or accidents. 

Therefore, the concept of imposing the 5 rem dose limit for design basis accidents is not 

applicable to acts of sabotage. (2-13)

Comment Summary U-4 : The staff’s proposed dose-based criterion is inadequate because it 

does not capture the long-term radiological and economic impacts of land contamination with 

long-lived fission products and actinides. Certain sabotage attacks may lead to hot plumes that 

would tend to disperse radionuclides more widely while reducing the calculated dose at the 

controlled area boundary. The NRC and the U.S. government continue to worry about the 

threat of "dirty bomb" attacks, which are not likely to result in many (or any) early fatalities but 

could cause significant long-term harm to the economy and to public health. A sabotage attack 

on an ISFSI could be regarded as a type of dirty bomb attack, and due consideration should be 

given to such long-term consequences even if the immediate radiological threat is determined to 

be low. (3-6)

NRC Response: Except as indicated otherwise in the specific responses below, the NRC staff

generally disagrees with these comments because they do not address or otherwise challenge 

the technical validity of the analyses on which the proposed 5-rem standard for security events 

is based. SECY-07-0148 and its Enclosure 2 discuss the basis for using the 5 rem dose limit as 

a security requirement, and explain the staff’s plans to revise 10 CFR part 73 by applying the 
-33-

existing 5 rem DBA dose limit in 10 CFR 72.106 to both safety and security events. To provide 

the necessary background, the staff first summarizes its 2007 discussion, and then summarizes 

the relevant portion of its 2009 draft regulatory basis. These summaries are followed by more 

specific responses to the individual comments above.

Extending the existing 5 rem DBA dose limit to security events provides consistency between 

the dose limits for ISFSI safety-related DBAs and acts of radiological sabotage. The cause of 

the dose will not be considered, as the 5 rem dose limit will be the same regardless of the 

initiating event. The staff recognized that its proposed rulemaking could present challenges for 

certain ISFSI licensees, due to the short distance between their storage casks and the nearest 

boundary of their controlled area. Licensees would be provided flexibility to evaluate the 

tradeoffs of increased security costs versus increased emergency planning costs in setting the 

distance to the controlled area boundary in order to meet the 5-rem dose limit requirements.

As discussed in the statements of consideration (SOC) accompanying the final rule initially 

promulgating 10 CFR Part 72 in 1980, the 5 rem accident dose limit was made part of 10 CFR 

72.68 (now 72.106) regarding the establishment of an ISFSI’s “controlled area” within the larger 

licensed site, and the 5 rem dose limit was derived from protective action guidelines (PAGs) 

recommended by the U.S. Environmental Protection Agency (EPA) for projected doses to 

populations for planning purposes. See 45 Federal Regulations 74693, 74697 (Nov. 12, 1980). 

Although not fully articulated in this 1980 SOC, the staff’s assumption was that establishing a 5-

rem dose limit at the nearest boundary of the controlled area, and requiring that this boundary 

be at least 100 meters from the nearest spent fuel cask (see existing 10 CFR 72.106(b)) --

rather than using a 1-rem standard dose limit at the larger site area boundary -- was intended to 

provide defense-in-depth to prevent any releases exceeding the EPA’s PAGs. 

Further, any sabotage-related release from an ISFSI would most likely be a prompt event, 

where any release occurs essentially immediately after the incident, and little (if any) time would 

exist for the licensee to recommend and then for State officials to initiate offsite protective action 

recommendations relative to the plume exposure (e.g., sheltering or evacuating). The dose to 

offsite personnel from the plume exposure would likely occur within a few minutes of a release 

from the ISFSI and would also terminate within a short time thereafter as opposed to a hot 

plume event. A hot plume event is defined as "hot" because the temperature is elevated. Hot 

plumes rise higher (have greater buoyancy) and would tend to be less concentrated at the 

controlled area boundary as a result. Effectively, an ISFSI security event could be considered a 

"puff" release. Because the bulk of the accrued dose from an ISFSI event would arise largely 

from inhalation and ingestion of the respirable particles, and not from the direct exposure to 

particles once they have fallen out of suspension and contaminated the ground, protective 

action recommendations such as sheltering in place or evacuating would likely only limit a small 

portion of the total dose received from most security events analyzed by the staff in its 2003 to 

2005 ISFSI security assessments.

With respect to Comment Summary U-1 above, the staff had intended to convey in the draft 

regulatory basis that the site boundary was larger than the controlled area boundary. This 

intended distinction is discussed in the Comment F4 response above. 
-34-

With respect to Comment Summary U-2 above, it provides no basis for choosing some higher 

value (i.e., greater than 5 rem) for security-based events, and the comment does not address or 

otherwise challenge the technical validity of the analyses summarized above. 

With respect to Comment Summary U-3 above, the NRC staff agrees that security events are 

not within the scope of the term “design basis accidents.” Accidents include natural phenomena 

(e.g. earthquakes or tornadoes) and made-made safety-related events (e.g., cask drop events 

or exceeding thermal limits during vacuum drying). Accordingly, security events are not part of 

the DBA concept, and while the Commission-approved recommendation will establish a dose 

limit for radiological sabotage consistent with the existing 5 rem dose limit for DBAs at ISFSIs, 

this does not mean that ISFSI licensees will be required to protect the spent fuel in storage 

casks against the design basis threat (DBT) for radiological sabotage.

Additionally, Comment Summary U-3’s reference to addressing the consequences of “sabotage 

attacks” in the context of “reducing the calculated dose at the controlled area boundary” 

incorrectly mixes the DBA and DBT concepts. The distinction between these concepts is 

shown, for example, in the existing 10 CFR 72.106 provisions requiring that all ISFSI and MRS 

sites establish controlled areas. Specifically, 10 CFR 72.106(b) establishes dose limits 

applicable to any “individual located on or beyond the nearest boundary of the controlled area,” 

and such individuals “may not receive from any design basis accident” the doses specified 

(emphasis added).

Comment U-4’s reference to the “economic impacts of land contamination” that an ISFSI 

sabotage attack could generate is similarly outside the scope of what ISFSI licensees must 

consider, and the NRC staff does not plan to establish a land contamination standard as part of 

this security rulemaking. This is consistent with the statement in the draft regulatory basis (at 5) 

that the proposed rule would not apply “the DBT for radiological sabotage to any ISFSIs or 

MRSs.”.

Additionally, after Comment U-4 was submitted in 2010, the staff in 2012 provided the 

Commission an assessment (see SECY-12-0110) of the NRC’s existing regulatory framework,

and evaluated whether NRC regulations should be modified to consider the economic 

consequences of unintended releases (i.e., accidental releases excluding those arising from 

deliberate sabotage events) of licensed nuclear materials to the environment. The SRM of 

March 20, 2013 approving SECY-12-0110 was silent on whether the economic consequences 

of releases arising from deliberate sabotage events should be addressed by NRC licensees. 

The Commission SRM directed the staff to perform additional analysis which may yield changes 

in policy in the future but, absent further Commission direction on this issue, the staff does not 

plan to develop a land contamination standard as part of its proposed security rulemaking.