ENCLOSURE

 

NRC STAFF ASSESSMENT AND PLANNED ACTIONS RELATED TO 

NATIONAL ACADEMY OF SCIENCES STUDY OF THE LESSONS LEARNED 

FROM THE FUKUSHIMA NUCLEAR ACCIDENT FOR IMPROVING 

SAFETY AND SECURITY OF U.S. NUCLEAR POWER PLANTS 

Summary 

The National Academy of Sciences (NAS) report entitled “Study of the Lessons Learned from 

the Fukushima Nuclear Accident for Improving Safety and Security of U.S. Nuclear Power 

Plants—Phase 2,” included several findings and recommendations related to the safety and 

security of nuclear power plants. The study paid particular attention to the safety and security of 

spent fuel storage, including reevaluating findings and recommendations from previous NAS 

reports.1 The U.S. Nuclear Regulatory Commission (NRC) staff has assessed the NAS findings 

and recommendations to determine whether additional actions or studies are warranted. 

Several of the NAS recommendations are addressed by recent reviews and assessments 

performed by the staff and by recent Commission decisions. The staff did not identify a need to 

initiate new activities or otherwise redirect resources to address recommendations in the 

Phase 2 study. As the NRC pursues its ongoing regulatory activities, the staff will consider if 

and how insights from the NAS study should be incorporated into associated studies, analyses, 

and decisionmaking. 

 

The staff concludes that spent fuel continues to be stored safely and securely at nuclear power 

plants in both spent fuel pools (SFPs) and dry casks. The security of U.S. nuclear power plants 

remains extremely robust. The NRC assessment of the current NAS study reflects an extensive 

history of how spent fuel safety and security have been assessed and improved in the United 

States. Significant enhancements to the safety and security of nuclear power plants, including 

SFPs, were made following the terrorist events of September 11, 2001, and the Fukushima 

accident in 2011. SFP safety was enhanced at U.S. reactors when licensees implemented new 

NRC requirements to develop strategies for SFP cooling following losses of large areas of the 

plant due to fires, explosions, or extreme natural events. The NRC will continue to cooperate 

with other Federal agencies and international organizations to assess threats to nuclear power 

plants and to improve risk assessment techniques. The staff will continue to bring policy 

matters to the Commission for consideration and action as appropriate.

 

 

1 Previous NAS reports refer to a study carried out in 2003-2004. That study focused on the safety and 

security of commercial spent fuel storage and resulted in two reports: a report containing classified and other 

security-sensitive information issued in 2004 (referred to as NAS 2004) and an abbreviated version suitable 

for unrestricted public release, issued in 2006 (referred to as NAS 2006). A description of the NRC’s 

assessment and actions related to that study are provided in a report to Congress issued in March 2005 

(Agencywide Documents Access and Management System (ADAMS) Accession No. ML050280428). 
- 2 - 

Background 

The conference report associated with the Consolidated Appropriations Act, 2012, directed the 

NRC to fund an NAS study of the lessons learned from the events at the Fukushima nuclear 

plant. The National Research Council (an operating agency of NAS) subsequently undertook 

an assessment for improving the safety and security of nuclear plants in the United States.2 

The study was organized to address the following issues: 

1) causes of the Fukushima nuclear accident, particularly with respect to the performance 

of safety systems and operator response following the earthquake and tsunami; 

2) reevaluation of the conclusions from previous NAS studies on safety and security of 

spent nuclear fuel and high-level radioactive waste storage, particularly with respect to 

the safety and security of current storage arrangements and alternative arrangements in 

which the amount of commercial spent fuel stored in pools is reduced; 

3) lessons that can be learned from the accident to improve commercial nuclear plant 

safety and security systems and operations; and 

4) lessons that can be learned from the accident to improve commercial nuclear plant 

safety and security regulations, including processes for identifying and applying designbasis events for accidents and terrorist attacks to existing nuclear plants. 

The NAS study was carried out in two phases. Phase 1 focused on the causes of the 

Fukushima Dai-ichi accident and safety-related lessons learned for improving nuclear plant 

systems, operations, and regulations, exclusive of spent fuel storage. The Phase 1 report, 

“Lessons Learned from the Fukushima Dai-ichi Nuclear Accident for Improving Safety of U.S. 

Nuclear Plants,” was issued in July 2014. The report documented various findings and 

recommendations. The staff review of and responses to the Phase 1 recommendations are 

described in Enclosure 6 of SECY-15-0059, “Seventh 6-Month Status Update on Response to 

Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Subsequent 

Tsunami,” dated April 9, 2015. The staff’s review of the Phase 1 report found that the NAS 

recommendations were being adequately addressed by activities undertaken by the NRC and 

nuclear industry following the Fukushima accident. The report associated with Phase 2 of the 

NAS study was issued in May 2016 and focused on three issues: 

1) security-related lessons learned from the Fukushima Dai-ichi accident for improving 

nuclear plant systems, operations, and regulations; 

2) lessons learned from the accident for improving safety of spent fuel storage; and 

3) reevaluation of the findings and recommendations from previous NAS reports on spent 

fuel storage safety and security. 

 

2 The previous NAS studies were prepared by the National Resource Council and are referred to within the 

NAS Phase 2 report using the abbreviation NRC (e.g., NRC (2006) for the NAS report issued in 2006). The 

NAS report also refers to the U.S. Nuclear Regulatory Commission by its full name or by the abbreviation 

USNRC. Within this document, abbreviations in quoted findings and recommendations are updated in 

brackets to match the reminder of the enclosure. 
- 3 - 

In conjunction with the evaluation documented in SECY-15-0059, this paper responds to 

Commission direction in the staff requirements memorandum (SRM) dated May 23, 2014, on 

COMSECY-13-0030, “Staff Evaluation and Recommendation for Japan Lessons-Learned Tier 3 

Issue on Expedited Transfer of Spent Fuel,” dated November 12, 2013. The staff was asked to 

consider the NAS study and report to the Commission the NAS findings and how they comport 

with further work on spent fuel management. 

Assessments and Planned Actions for NAS Recommendations 

The major findings and related recommendations from the Phase 2 report are provided in the 

following sections, along with the staff’s assessment and planned actions related to each 

recommendation. 

Recommendation 2.1: Spent Fuel Pool Monitoring and Remote Cooling Capabilities 

Finding 2.1: The spent fuel storage facilities (pools and dry casks) at the Fukushima Dai-ichi 

plant maintained their containment functions during and after the March 11, 2011, earthquake 

and tsunami. However, explosions in the Unit 1, 3, and 4 reactor buildings damaged spent fuel 

handling facilities and equipment, introduced heavy debris into the pools, and provided 

enhanced pathways for releases of radioactive materials from the damaged reactors into the 

environment. These events hindered efforts by plant operators to monitor conditions in the 

pools and restore critical pool-cooling functions. The lack of reliable real-time information about 

the pools created substantial difficulties in responding to the accident and led to increased 

public anxiety. Nevertheless, plant personnel were able to improvise and provide needed 

cooling to avoid pool uncovery and potential radiological consequences. The leakage of water 

into the Unit 4 pool from the reactor well/dryer-separator pit was a key factor for determining its 

water level and may have prevented fuel uncovery before plant personnel were able to add 

water. 

Recommendation 2.1: The U.S. nuclear industry and its regulator should give additional 

attention to improving the ability of plant operators to measure real-time conditions in [SFPs] 

and maintain adequate cooling of stored spent fuel during severe accidents and terrorist 

attacks. These improvements should go beyond the current post-Fukushima response to 

include hardened and redundant (1) physical surveillance systems (e.g., cameras), (2) radiation 

monitors, (3) pool temperature monitors, (4) pool water-level monitors, and (5) means to deliver 

pool makeup water or sprays even when physical access to the pools is limited by facility 

damage or high radiation levels. 

NRC Staff Assessment and Planned Actions: 

After the Fukushima accident, the NRC identified possible improvements to the monitoring and 

cooling of SFPs, performed assessments, and issued orders to require additional 

instrumentation and capabilities to supply water to SFPs. The additional SFP level indications 

required by the NRC enable operators to maintain an awareness of SFP conditions during 

beyond-design-basis events and security events that might disable other installed equipment 

and instrumentation. This awareness of the conditions within the SFP supports the operators’ 

need to prioritize response actions to maintain or restore cooling to the reactor core and SFP. 
- 4 - 

The added capabilities for SFP cooling built upon the enhancements made following the terrorist 

events of September 11, 2001, and include a means to supply makeup water to the pool without 

accessing the refueling floor. The Fukushima Near-Term Task Force (NTTF) recommended 

and the NRC considered requiring additional instruments for SFP water temperature and other 

means of monitoring conditions within the SFP, but concluded that the actions taken adequately 

addressed the lessons learned from the Fukushima accident and requiring additional 

enhancements was not warranted. Additional details on the NRC’s assessments and actions 

taken are provided below. 

In SRM-SECY-12-0025, dated March 9, 2012, the Commission approved the issuance of Order 

EA-12-049, “Mitigation Strategies for Beyond-Design-Basis External Events,” and Order 

EA-12-051, “Reliable Spent Fuel Pool Instrumentation.” These orders were two of the highest 

priority actions taken by the NRC to enhance safety because of the Fukushima accident. 

Order EA-12-049 requires all nuclear power plant licensees to develop, implement, and 

maintain guidance and strategies to maintain or restore core cooling, containment, and SFP 

cooling capabilities following a beyond-design-basis external event. 

Order EA-12-051 requires all nuclear power plant licensees to have a reliable indication of the 

water level in [SFPs] capable of supporting identification of the following pool water level 

conditions by trained personnel: (1) level that is adequate to support operation of the normal 

fuel pool cooling system, (2) level that is adequate to provide substantial radiation shielding for a 

person standing on the SFP operating deck, and (3) level where fuel remains covered and 

actions to implement make-up water addition should no longer be deferred. 

In SECY-15-0059, “Seventh 6-Month Status Update on Response to Lessons Learned from 

Japan’s March 11, 2011, Great Tohoku Earthquake and Subsequent Tsunami,” dated 

April 9, 2015, the NRC responded to a similar recommendation in the NAS Phase 1 report 

related to requiring instrumentation for monitoring critical thermodynamic parameters in SFPs. 

The NRC’s assessment of the NAS recommendation in that report was as follows: 

In the course of developing Order EA-12-051, the NRC considered requiring 

instruments for SFP water temperature and area radiation levels, as the NTTF 

had recommended. In light of the underlying technical justification for requiring 

the reliable level instrumentation, avoiding distracting resources from addressing 

problems with the reactor plant itself, which can progress more rapidly, the NRC 

concluded that these extra sensors would not be necessary. SFPs at reactor 

facilities in the U.S. are licensed to rely on heat removal through boiling water 

within the SFP. The loss of water within the SFP occurs through boil-off at a 

slow rate such that the level instrumentation alone can supply sufficient 

information for the operators to prioritize resources to mitigate events. 

As a part of the additional requirements developed after the terrorist events of 

September 11, 2001, the NRC required licensees to have capabilities and strategies to provide 

SFP cooling following the loss of large areas due to fires or explosions. This requirement was 

incorporated into Section 50.54(hh)(2) of Title 10 of the Code of Federal Regulations (10 CFR). 

The NRC has endorsed guidance provided in Nuclear Energy Institute (NEI) 06-12, “B.5.b 

Phase 2 & 3 Submittal Guideline,” for licensees complying with the requirements of 
- 5 - 

10 CFR 50.54(hh) in areas of firefighting, mitigating fuel damage, and minimizing radiological 

releases. The guidance specifies that portable, power-independent pumping capabilities must 

be able to provide at least 500 gallons per minute (gpm) of bulk water makeup to the SFP, and 

at least 200 gpm of water spray to the SFP. Recognizing that the SFP is more susceptible to a 

release when in a nondispersed configuration, the guidance also specifies that the portable 

equipment is to be capable of being deployed within 2 hours for a nondispersed configuration, 

from the time plant personnel diagnose that external SFP makeup is required, and within 5 

hours when the SFP is in a dispersed (e.g., 1 × 4 pattern) configuration. 

After the Fukushima Dai-ichi accident, the NRC took extensive actions to ensure that portable 

equipment is available to mitigate a loss of cooling water in the SFP. To meet the requirements 

of Order EA-12-049, the NRC endorsed NEI document NEI 12-06, “Diverse and Flexible Coping 

Strategies (FLEX) Implementation Guide.” Section 3.2.2, “Minimum Baseline Capabilities,” of 

NEI 12-06 provides guidance for supplying makeup water to the SFP. This guidance document 

states: “The FLEX fluid connections for core and SFP cooling functions are expected to have a 

primary and an alternate connection or delivery point (e.g., the primary means to put water into 

the SFP may be to run a hose over the edge of the pool).” 

The NRC finds that this guidance will provide additional mechanisms for mitigating a loss of 

SFP cooling water beyond that required by 10 CFR 50.54(hh)(2). An example of such an 

upgrade is the installation of a remote connection for SFP make-up water that can be accessed 

away from the SFP refueling floor. These requirements will ensure additional mitigation 

capability is in place in the unlikely event in which degrading conditions occur in the SFPs 

because of beyond-design-basis external events. The additional capabilities could also be 

useful during security events when either parameter indications or communications related to an 

attack reveal that the cooling of the spent fuel might be compromised. 

In conclusion, the staff has evaluated NAS Recommendation 2.1 and concludes that the 

additional requirements for spent fuel pool monitoring and cooling capabilities imposed on U.S. 

nuclear power plants following the Fukushima accident adequately address the lessons learned 

from that accident. The NAS report does not provide new information that would change the 

staff’s previous findings that SFP instrumentation and pool makeup capabilities beyond those 

imposed by NRC orders would not provide a substantial increase in the overall protection of the 

public health and safety or the common defense and security. Therefore, the staff does not plan 

to perform additional analyses or pursue imposing additional regulatory requirements as 

described in NAS Recommendation 2.1. Many licensees are already in compliance with the 

orders issued by the NRC related to mitigating strategies and SFP level instrumentation. The 

staff is in the process of documenting the acceptability of licensees’ plans for mitigating 

strategies and inspecting each licensee’s implementation of the orders related to mitigating 

strategies and SFP level instrumentation. Additionally, the NRC is preparing a final rule on 

mitigation of beyond-design-basis events. This rule, if approved by the Commission, will 

incorporate the requirements of Orders EA-12-049 and EA-12-051 into the CFR, taking into 

account lessons learned in their implementation and feedback from stakeholders received 

during the rulemaking process. 

Recommendation 3.1: Beyond-Design-Basis External Event Security Requirements 

Finding 3.1: Extreme external events and severe accidents such as occurred at the Fukushima 

[Dai-ichi] plant can cause widespread and long-lasting disruptions to security infrastructure, 
- 6 - 

systems, and staffing at nuclear plants. Such disruptions can create opportunities for 

malevolent acts and increase the susceptibility of critical plant systems to such acts.

Recommendation 3.1: Nuclear plant operators and their regulators should upgrade and/or 

protect nuclear plant security infrastructure and systems and train security personnel to cope 

with extreme external events and severe accidents. Such upgrades should include: 

• Independent, redundant, and protected power sources dedicated to plant security 

systems that will continue to function independently if safety systems are damaged; 

• Diverse and flexible approaches for coping with and reconstituting plant security 

infrastructure, systems, and staffing during and following extreme external events and 

severe accidents; and 

• Training of security personnel on the use of these approaches. 

The U.S. nuclear industry should consider expanding its [FLEX] capability to address this 

recommendation. The [NRC] should support industry’s efforts by providing guidance on 

approaches and by overseeing independent review by technical peers (i.e., peer review). 

NRC Staff Assessment and Planned Actions: 

The NRC has numerous requirements for security system redundancies and backup power 

supplies, and preplanned compensatory measures are required to be implemented in the event 

that normal security systems are degraded. The NRC performed various assessments and took 

regulatory actions after the terrorist events of September 11, 2001, and the Fukushima accident 

on March 11, 2011. The requirements imposed on licensees improved the integration of safety 

and security activities at nuclear power plants and added capabilities to support responding to a 

variety of external threats and hazards. For example, licensees are required to maintain the 

capability to detect and assess unauthorized persons at all times. The NRC also requires in 

10 CFR 73.55 that licensees have a tested uninterruptible power supply for these systems, 

secondary power supplies within vital areas to support alarms and certain communications 

equipment, and continuous communication with onsite and offsite resources for command and 

control. 

Additionally, the NRC is preparing a final rule on mitigation of beyond-design-basis events. This 

rule, if approved by the Commission, will result in a more integrated accident response 

capability, including an enhanced emergency preparedness capability for beyond-design-basis 

threat and/or accident events. The proposed changes will affect many aspects of the facility, 

including requirements associated with emergency preparedness, off-site coordination, and 

safety/security interface. As currently drafted, the proposed rule would require licensees to be 

capable of mitigating an extended loss of alternating current power resulting from 

beyond-design basis threat and/or accident events through a variety of response guidelines 

(FLEX support guidelines, emergency operating procedures, etc.), as well as the training and 

qualification of personnel that are designated to perform duties and responsibilities in 

accordance with those guidelines. Although not specifically designed to mitigate security 

threats concurrent with a natural disaster, the actions being implemented under Order 

EA-12-049 and this rule provide additional response capabilities that could be used during such 

an event. 
- 7 - 

The actions taken have also improved coordination within the nuclear industry and with local 

and Federal agencies that might be called upon to respond to security events or natural 

disasters affecting a nuclear power plant. The NRC considered additional measures to enhance 

security at nuclear power plants but concluded that the actions taken adequately addressed the 

lessons learned from the terrorist events of September 11, 2001, and the Fukushima accident. 

A key consideration in this evaluation was the unlikely nature of a security event such as the 

design-basis threat occurring coincident with a natural disaster large enough to significantly 

affect a site’s security posture. This initiating event, while theoretically possible, is not a 

vulnerability that can be easily exploited given the enhanced measures taken at nuclear power 

plants. 

In conclusion, the staff has evaluated NAS Recommendation 3.1 and finds that existing security 

requirements for U.S. nuclear power plants and additional capabilities implemented following 

the Fukushima accident provide adequate protection against possible disruptions to security 

infrastructure following a natural disaster. The additional requirements proposed by NAS to 

address concurrent natural disasters and security events would not provide the substantial 

increase in the overall protection of the public health and safety or the common defense and 

security required for the NRC to impose additional regulatory requirements. The staff is in the 

process of documenting the acceptability of licensees’ plans for mitigating strategies and 

inspecting each licensee’s implementation of the orders related to mitigating strategies and SFP 

level instrumentation. The staff will also continue with the mitigating strategies rulemaking 

activities. In addition, the NRC will continue to inspect and assess licensees’ security programs, 

work with other Federal agencies to assess possible threats, and participate in interagency and 

international efforts to ensure an appropriate level of security is maintained for NRC-regulated 

facilities. 

Recommendation 4.1A: Use of Risk in Security Activities 

Finding 4.1: The understanding of security risks at nuclear power plants and spent fuel storage 

facilities can be improved through risk assessment. Event trees and other representational 

formalisms can be used to systematically explore terrorist attack scenarios, responses, and 

potential consequences. Expert elicitation can be used to rank scenarios; develop likelihood 

estimates; and characterize adaptive adversary responses to various preventive, protective, or 

deterrence actions. The identification of scenarios may be incomplete, and the estimates 

developed through expert elicitation are subjective and can have large uncertainties. 

Nevertheless, risk assessment methods that focus on the risk triplet—scenarios, likelihoods, 

and consequences—can contribute useful security insights. 

Recommendation 4.1A: The U.S. nuclear industry and the [NRC] should strengthen their 

capabilities for identifying, evaluating, and managing the risks from terrorist attacks. Particular 

attention is needed to broaden scenario identification, including asymmetric attacks; account for 

the adaptive nature of adversaries; account for the performance of plant security personnel in 

responding to the identified scenarios; estimate the potential onsite and offsite consequences of 

attack scenarios, including radioactive releases and psychological impacts; and develop 

strategies for countering the identified threats. 
- 8 - 

NRC Staff Assessment and Planned Actions: 

The NRC has used and will continue to use risk insights in the security area to ensure an 

appropriate level of security is maintained at NRC-regulated facilities. Some aspects of the riskinformed approach described in the NAS report are included in existing security programs, 

including developing security plans and testing those plans in exercises. As opportunities arise, 

the NRC will cooperate with other Federal agencies to develop or use risk management 

approaches to improve the protection of critical infrastructure and key assets. Consistent with 

the NRC’s probabilistic risk assessment (PRA) policy statement, the staff considers risk insights, 

as appropriate, in processing security-related licensing actions and supports further use of risk 

assessment techniques in security applications. Additional details on the NRC’s assessments 

and actions taken are provided below. 

The traditional approach to plant security evolved to include designing and putting in place 

systems, barriers, and personnel to detect, delay, and respond to possible attempts by 

adversaries to sabotage a nuclear power plant. Security programs were enhanced based on 

lessons learned from studies, drills, and operating events. Physical protection requirements for 

power reactors (see 10 CFR 73.55, “Requirements for Physical Protection of Licensed Activities 

in Nuclear Power Reactors against Radiological Sabotage”) mandate the need for two onsite 

alarm stations to ensure that a single act cannot disable the ability to detect and assess alarms, 

initiate and coordinate a response, summon offsite assistance, and provide command and 

control. Although security programs incorporated some plant structures and features 

(e.g., walls, access points), plant designs, and the arrangement of key safety systems were 

primarily defined by other design objectives (e.g., design-basis events involving equipment 

failures or natural events). Lessons learned from some events included the need to better 

coordinate systems and procedures related to plant security and the operation of key safety 

systems. The need to coordinate the activities related to plant safety and security were 

incorporated into NRC regulations (see 10 CFR 73.58, “Safety/Security Interface Requirements 

for Nuclear Power Reactors,” and Regulatory Guide 5.74, “Managing the Safety/Security 

Interface”). The relationships between safety and security features also supported further study 

of using risk assessment techniques to evaluate both security and non-security related events. 

The NRC and industry response to the terrorist events of September 11, 2001, included plant 

changes as part of mitigating strategies to maintain or restore core cooling, containment, and 

spent fuel pool cooling capabilities under the circumstances associated with loss of large areas 

of the plant due to explosions or fire. The NRC works continually with other Federal agencies to 

assess the possible nature and likelihood of security threats, and determine if changes to plant 

security programs are needed. 

The staff is working with licensees and organizations to enhance the use of risk management 

and risk assessment techniques in the security arena. Examples of ongoing work include 

engagement with industry on methods involving consequence based approaches, the use of 

PRA, and the use of computer modeling tools to inform site-specific protective strategies. 

Licensees are required by 10 CFR 73.55(b)(4) to identify site-specific conditions, including 

target sets, that should be considered in the implementation of their physical protection 

programs. Licensees use PRAs among several assessment/analytic tools in determining 

potential target sets within the nuclear power plant. Risk insights are also used in other aspects 

of developing security programs and testing those programs in various drills and exercises, 

including the NRC’s force-on-force security inspections. Another example of work in this area 

relates to the NRC’s review of Revision 16 to the Monticello Protective Security Plan (ADAMS 
- 9 - 

Accession No. ML15286A032), submitted in October 2015, which uses computer modeling and 

other analytic techniques to inform the licensee’s security plan, including the appropriate 

number of armed responders and armed security officers at the plant. These activities include 

broadening scenario identification, including asymmetric attacks and accounting for the adaptive 

nature of adversaries, as well as the licensees’ ability to detect, delay, and respond to various 

security events. 

Staff have also participated in meetings with subject matter experts and stakeholders to provide 

additional insights in the areas of security that might benefit from developing and implementing 

improved risk-informed approaches. 

Additional examples of ongoing work in the security area that are using risk insights include: 

• Staff is developing an approach to grade special nuclear material security requirements 

based on the attractiveness of the nuclear material to the adversary. This will allow 

licensees (fuel cycle facilities and research and test reactors) to use alternative 

measures for varying levels of radiological hazard. 

• Regarding cyber security (see 10 CFR 73.54), reactor cyber security implementation is 

under way. As part of this effort, the highest-consequence critical digital assets (CDAs) 

are being addressed using a consequence-based approach, which will allow for the 

consideration of lesser requirements for CDAs with lower consequences. 

• Staff is working with the International Atomic Energy Agency (IAEA) on a coordinated 

research project to develop nuclear security assessment methodologies. This project 

will allow for member countries to have equivalent standards on the conduct of security 

assessments. Case studies are underway (or have been completed) for a nuclear 

power plant, an irradiator facility, transport of radioactive materials, low enriched uranium 

fuel fabrication facility, and a spent fuel storage facility. These assessments are 

conducted with the use of risk insights. 

The NRC’s Policy Statement on the Regulation of Advanced Reactors was revised in 2008 to 

provide expectations and guidance on security matters to prospective applicants so that they 

can use this information early in the design stage of new reactors to identify potential mitigative 

measures and design features that provide a more robust and effective security posture. 

Designers of small modular reactors and non-light-water reactors are integrating plant safety 

features and security measures and using PRAs in the design of both plant safety and physical 

protection systems. The staff are working with potential applicants and other stakeholders to 

improve the security framework and manage the risks from terrorist attacks for future nuclear 

power plants. 

The NAS report describes possible asymmetric threats where an adversary might choose to 

attack a plant’s support infrastructure (e.g., offsite power and water supplies, key personnel) 

rather than mounting a direct assault on the plant. Attacks on offsite targets would have effects 

similar to events addressed by requirements for the design and operation of nuclear power 

plants (e.g., loss of offsite power). Such actions could cause plant transients and economic 

losses, but they are unlikely to lead to more severe reactor accidents or the release of 

radioactive material. Other Federal, State, and local agencies have robust programs for 

assessing threats and developing plans to protect critical infrastructure and key assets. Unlike 
- 10 - 

the series of events that occurred at Fukushima, which included the loss of plant safety systems 

because of the tsunami, it is unlikely that adversaries could initiate cascading failures leading to 

a radiological release without mounting an assault against a facility and its associated security 

systems and personnel. 

In conclusion, the staff has evaluated NAS Recommendation 4.1A and finds that existing 

security requirements and the NRC’s continuous interactions with other Federal agencies to 

assess possible threats sufficiently address the security-related risks to nuclear power plants. 

The staff did not identify a need to initiate new activities or otherwise redirect resources to revise 

existing programs or accelerate initiatives to enhance the use of risk assessment techniques in 

the security area. The NRC will continue to work with other Federal agencies, licensees, and 

other stakeholders, as described above, to improve the use of risk assessment techniques and 

risk management in maintaining security at nuclear power plants. 

Recommendation 4.1B: Security Risk Assessment of Spent Fuel Storage 

Recommendation 4.1B: The [NRC] should sponsor a spent fuel storage (wet and dry storage) 

security risk assessment for U.S. nuclear plants. The primary objectives of this assessment 

should be to (1) develop and exercise the appropriate methodologies for characterizing risk and 

estimating uncertainties, and (2) explore the benefits of risk assessment for enhancing security 

at U.S. nuclear plants. This assessment should be subjected to independent review by 

technical peers (i.e., peer review) as part of the development process. 

NRC Staff Assessment and Planned Actions: 

The NRC is participating in activities evaluating how risk assessment techniques might improve 

defining and implementing an appropriate level of security at NRC-licensed facilities. Currently, 

the staff is working with the IAEA to develop nuclear security assessment methods for nuclear 

facilities, including spent fuel storage facilities. The NRC also works in coordination with other 

Federal agencies in assessing possible threats and establishing requirements to address 

security-related risks. Additional details on the NRC’s assessments and actions taken are 

provided below. 

After the terrorist events of September 11, 2001, the NRC conducted security assessments at 

nuclear facilities. These assessments evaluated attacks with large aircraft and ground assaults 

using a variety of methods as well as expected response to these assaults by both on-site 

(licensee) and off-site (Federal, State, and local) resources/agencies. These assessments 

considered PRA-like insights in terms of event sequences and consequences. The 

assessments did not specifically attempt to estimate frequencies or probabilities associated with 

the threats and defensive measures. Additionally, the NRC analyzed several different dry cask 

storage designs, which were viewed as representative of the entire population of dry cask 

storage systems. The results of these assessments indicated that no immediate changes in the 

security requirements for independent spent fuel storage installations (ISFSIs) were necessary. 

The NRC’s assessment of the findings and recommendations in the 2006 report issued by NAS 

similarly concluded that activities to improve risk analysis techniques for spent fuel storage 

would continue but that spent fuel continues to be stored safely and securely at nuclear power 

plants in both SFPs and dry casks. 
- 11 - 

The staff is working with the IAEA on a coordinated research project to develop nuclear security 

assessment methodologies. One aspect of this project is to develop a standardized 

methodology on the conduct of security assessments for a spent fuel storage facility. This 

assessment would be conducted with the use of risk insights. 

In conclusion, the staff has evaluated NAS Recommendation 4.1B and did not identify new 

information or security concerns that would warrant regulatory actions. Insights and 

suggestions from the NAS report are consistent with other observations from within and outside 

the NRC on the current and potential uses of risk assessment techniques for evaluating plant 

security. As a result, the staff does not see a need to initiate new activities or otherwise redirect 

resources to revise existing programs or accelerate initiatives to enhance the use of risk 

assessment techniques associated with the security risk assessment of fuel storage. 

Recommendation 4.3: Independent Assessment of NRC Security Programs 

Finding 4.3: The [NRC] has not carried out an independent examination of surveillance and 

security measures for protecting stored spent fuel that was recommended by [NAS 2006].3

Recommendation 4.3: The independent examination of surveillance and security measures 

for protecting stored spent fuel recommended by [NAS 2006] should include an examination of 

the effectiveness of the [NRC’s] programs for mitigating insider threats. 

NRC Staff Assessment and Planned Actions: 

The NRC establishes strategic goals and measures and provides routine reports regarding its 

performance. Because the nature of the agency’s safety and security strategic objectives is to 

prevent or minimize undesirable outcomes, the desired trends for all of its performance 

indicators are to maintain these outcomes at either zero or at very low levels. As an 

independent agency created by Congress in 1974, the NRC issues annual reports of its 

performance in maintaining the safety and security of commercial nuclear power plants. The 

agency is subject to the oversight of applicable congressional committees. In the security 

arena, the NRC works closely with other Federal agencies to identify and address possible 

threats. In addition to the NAS studies, the NRC has obtained independent assessments in the 

security area from the NRC’s Office of the Inspector General (OIG), U.S. Government 

Accountability Office (GAO), and other oversight bodies. Regarding the specific mention of 

insider threats in the NAS report, the NRC has established requirements and oversees 

licensees’ programs to protect against such threats. Additional details on the NRC’s 

assessments and actions taken are provided below. 

Independent assessments of the effectiveness, adequacy, and efficiency of programs, including 

security program requirements for protecting spent nuclear fuel and insider threat mitigation, 

can be beneficial. The NRC performs such independent assessments of licensees’ programs. 

Various organizations independent from the NRC routinely assesses the NRC’s regulation and 

 

3 The 2006 NAS report Recommendation 2C stated: Although the committee did not specifically investigate 

the effectiveness and adequacy of improved surveillance and security measures for protecting stored spent 

fuel, an assessment of current measures should be performed by an [organization independent of the NRC 

and the nuclear industry].” 
- 12 - 

oversight of licensees. The NRC’s OIG has full operational independence to select, plan, and 

conduct its work. Additionally, the GAO is required to maintain a high degree of integrity, 

objectivity, and independence for audits of government entities, such as the NRC. 

There have been numerous assessments of the NRC’s spent fuel safety and security regulatory 

programs by both the OIG and GAO since 2001. 

Examples of OIG audits pertaining to security issues include: 

• Audit OIG-12-A-10, “Audit of NRC’s Management of the Baseline Security Inspection 

Program,” dated March 8, 2012. This audit identified a recommendation for a more 

systematic approach to analyzing security findings data across the board that can help 

staff better identify licensee performance trends. The staff is currently developing a new 

computer program that will respond to the OIG recommendation. 

• Audit OIG-11-A-10, “Audit of NRC’s Oversight of ISFSI Security,” dated May 3, 2011. 

This report provided a number of recommendations to improve the agency’s ISFSI 

security program. The staff accepted and implemented the OIG recommendations. 

• Audit OIG-10-A-21, “Audit of NRC's Oversight of the Access Authorization Program for 

Nuclear Power Plants,” dated September 30, 2010. This report touched on the insider 

threat mitigation program by making a number of recommendations to the NRC’s access 

authorization program. The staff agreed with and implemented all of the OIG 

recommendations. 

Examples of GAO audits pertaining to security issues include: 

• Report GAO-12-797, “Spent Nuclear Fuel: Accumulating Quantities at Commercial 

Reactors Present Storage and Other Challenges,” dated August 2012. One of the 

objectives of this report was to examine the key safety and security risks posed by spent 

fuel stored at reactor sites and actions to help mitigate these risks. GAO recommended 

that the NRC develop a mechanism for locating all classified studies. The NRC 

generally agreed with the findings and the recommendation in the report. 

• Report GAO-07-1197R, “Nuclear Security: DOE [Department of Energy] and NRC Have 

Different Security Requirements for Protecting Weapons-Grade Material from Terrorist 

Attacks,” dated September 2007. This report examined DOE’s and the NRC’s 

requirements for protecting Category I special nuclear material from terrorist threats. 

The NRC agreed with several of the recommendations; however, the NRC disagreed 

with a recommendation to develop a common design basis threat for facilities that store 

and process Category I special nuclear material. 

• Report GAO-03-426, “Spent Nuclear Fuel: Options Exist to Further Enhance Security,” 

dated July 2003. Considering that this report was issued shortly after the terrorist events 

of September 11, 2001, the NRC was still in the midst of developing and implementing 

new safety and security requirements. Safety and security measures have been greatly 

enhanced since that time. 
- 13 - 

Additionally, the NRC hosts peer-review missions, including the IAEA’s Integrated Regulatory 

Review Service (IRRS) and International Physical Protection Advisory Service (IPPAS). The 

NRC’s first IRRS mission was held in October 2010 and focused on the operating power reactor 

program. A follow-up mission occurred in February 2014 and reviewed the NRC’s response to 

the 2010 mission’s findings and the NRC’s response to the Fukushima accident. An IPPAS 

mission was hosted by the United States in October 2013 and reviewed nuclear security-related 

legislative and regulatory framework. 

In addition to its self-assessments and independent assessments from outside organizations, 

the NRC gains insights into security and safety programs from many other sources. The staff 

routinely assesses information gained from operating experience reported to the agency or 

gathered as part of the inspection program. The staff also gains insights from drills and 

exercises, including the force-on-force security inspections. Additional insights and related 

assessments result from petitions, correspondence, and other public interactions. The NRC is 

also able to compare its security programs with those of other countries though its participation 

in various international organizations. Close cooperation with other Federal agencies includes 

the opportunity for security specialists outside of the NRC to assess and provide suggestions on 

the protection of commercial nuclear facilities. 

The Phase 2 NAS study made specific mention of including potential issues with insider threats 

within the recommended independent assessment. All commercial nuclear power plants 

employ an insider threat mitigation program, which is a defense-in-depth approach that is based 

on requirements codified 10 CFR Part 73, “Physical Protection of Plants and Materials.” The 

approach for complying with these requirements is incorporated into the security plans for each 

nuclear plant and these plans are a condition of the plant’s license to operate. The overall 

objective of the NRC’s insider threat mitigation program is to provide for licensee oversight and 

monitoring of the initial and continuing trustworthiness and reliability of individuals having 

unescorted access and unescorted access authorization at nuclear plants. To accomplish this 

objective, the insider threat mitigation program includes overlaying components that use initial 

screening for trustworthiness and reliability, behavior observation once access has been 

granted, self-reporting, physical security such as limitations on access to vital areas and 

detection of contraband, cyber security, and fitness-for-duty. The initial and continuing 

monitoring of individuals includes a criminal history check with the Federal Bureau of 

Investigation, pre-access alcohol and drug testing, random and for-cause drug and alcohol 

testing, psychological testing and evaluation, documented annual reviews by immediate 

supervisors, and reinvestigation of individuals in selected positions. The security requirements 

are complemented by instrumentation, inspections, and other aspects of plant operation that 

provide confidence in the readiness of plant equipment to maintain or restore safety functions. 

In summary, the staff has evaluated NAS Recommendation 4.3 and concludes that it is not 

necessary to redirect resources to another independent assessment given that the NRC’s 

requirements and related programs to ensure security of nuclear power plants and spent fuel 

storage will continue to be subject to independent reviews by the OIG, GAO, and other 

organizations. The staff will continue to benefit from independent insights gained from 

interactions with other Federal agencies, international bodies, licensees, and other 

stakeholders. 
- 14 - 

Recommendation 4.6: End-to-End Validation of MELCOR 

Finding 4.6: Additional analyses and physical experiments carried out by the [NRC] and 

Sandia National Laboratories since [NAS 2006] was completed have substantially improved the 

state of knowledge of boiling water reactor (BWR) and pressurized water reactor (PWR) spent 

fuel behavior following partial or complete loss of pool water. These studies and experiments 

have addressed the following important issues: 

• Fuel damage state and timing as a function of fuel age and pool water loss; 

• Propagation of zirconium cladding fires to other assemblies in the pool; and 

• Potential mitigation strategies (dispersion of hot fuel assemblies in the pool, water 

sprays, water replacement) for delaying or preventing fuel damage following pool water 

loss. 

These experiments have resulted in significant validation of MELCOR that is used to model 

coolant loss in SFPs. However, the code is unable to adequately model flows when stratification 

occurs and plumes form in the pool or above-pool environment. Moreover, key portions of code 

lack validation, and there has been no end-to-end validation of the code for modeling coolant 

loss in SFPs. 

Recommendation 4.6: The U.S. Nuclear Regulatory Commission should (1) sponsor an 

end-to-end validation of the MELCOR code for use in modeling coolant loss in SFPs, and 

(2) validate key submodels in the code with particular attention paid to: 

• Modeling the thermal and chemical behavior of spent fuel assemblies in partially drained 

pools. 

• Modeling the thermal and chemical response of spent fuel assemblies to the application 

of water sprays. 

• Modeling and validating for stratified flows in fully and partially drained pools. 

NRC Staff Assessment and Planned Actions: 

The staff has assessed NAS Recommendation 4.6 and has determined that the most important 

phenomena relevant to severe accident progression (e.g., fuel heatup and radioactive release) 

are modeled in MELCOR, supported by experimental validation, and are sufficient for current 

regulatory applications. The staff considers the code to be a state-of-the-art tool for severe 

accident and source term analysis, which can be used to inform regulatory decisions, where 

uncertainties are appropriately considered in the analyses results. Improvements, including 

those specifically mentioned in the NAS report, are continuously evaluated and are being 

implemented as appropriate to further reduce uncertainties. Additional details on the NRC’s 

assessments and actions taken are provided below. 

With respect to the capabilities of the code and its validation, the staff believes that MELCOR 

can mechanistically model the important physical phenomena given inherent uncertainties in 

accident progression phenomenology and is suitable for the current regulatory applications. 
- 15 - 

The code models have been developed over the past few decades, and the code has been 

benchmarked against many experiments including separate and integral effects tests for a wide 

range of phenomena (including situations where the nuclear fuel is partially covered by water) 

as documented in Volume 3 of the computer program manuals (ADAMS Accession 

No. ML15300A476). As noted in the NAS report, code assessments include a series of 

experiments conducted between 2004 and 2012 that specifically investigated fuel heatup and 

ignition during SFP accidents. The findings from the experimental programs and the MELCOR 

assessments have been documented in NUREG/CR-7143 for BWR assemblies and 

NUREG/CR-7215/16 for PWR assemblies. Since any new regulatory application of MELCOR 

requires a targeted assessment of the code, the staff believes that an “end-to-end” validation 

effort is not cost effective or necessary. 

When being used to inform regulatory decisions, MELCOR is used to perform best estimate 

analysis, and uncertainty analysis is used to better understand and bound phenomenological 

uncertainties. The uncertainties need to be appropriately considered in the analysis results to 

take into account issues such as those raised in the NAS study. For example, Section 9 of the 

SFP study (NUREG-2161, “Consequence Study of a Beyond-Design-Basis Earthquake 

Affecting the Spent Fuel Pool for a U.S. Mark I Boiling Water Reactor,” dated September 2014) 

is devoted to discussion of the major uncertainties that can affect the radiological releases (e.g., 

hydrogen combustion, core concrete interaction, multiunit or concurrent accident, fuel loading). 

In addition, the regulatory analysis in COMSECY-13-0030, “Staff Evaluation and 

Recommendation for Japan Lessons-Learned Tier 3 Issue on Expedited Transfer of Spent 

Fuel,” dated November 12, 2013, relied on SFP study insights for the BWRs with Mark I and II 

containments, and even then, the results were conservatively biased toward higher radiological 

releases. For other designs, the release fractions were based on previous studies (e.g., 

NUREG-1738, “Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear 

Power Plants,” dated February 2001) that used simplifying assumptions biasing the results 

towards higher radiological releases. 

In addition, the staff has recently completed an overall assessment of its approach to SFP 

severe accident evaluations. In SECY-15-0146, “Denial of Petition for Rulemaking Requesting 

Amendments Regarding Spent Fuel Pool Severe Accident Evaluations (PRM-50-108; NRC2014-0171),” dated November 19, 2015, the staff evaluated a petition for rulemaking that raises 

a similar issue as what NAS recommends. One particular issue that the staff evaluated in this 

paper, among others, was an assertion that MELCOR is not currently sufficient to provide a 

conservative evaluation of postulated SFP accident/fire scenarios. The staff provided a similar 

rationale as discussed above and recommended the Commission deny the petition. The 

Commission decision approving the denial of this petition is documented in SRM-SECY-15-

0146, dated April 4, 2016. 

Nevertheless, additional assessment of MELCOR for certain aspects of partial draindown, fluid 

flow stratification, and spray flow modeling suggested in the NAS report can enhance the code 

capabilities and the user’s confidence in the results. The DENOPI (SFP loss-of-cooling and 

loss-of-coolant accident) project that is coordinated by the French research organization Institut 

de Radioprotection et de Sûreté Nucléaire is aimed at producing additional quantitative 

information about SFP accidents, especially under partial draindown conditions. The NRC is 

cognizant of these efforts through its bilateral Cooperative Severe Accident Research Program 

agreements with France and other countries involved in MELCOR applications. The staff 

supports these activities and will use the results of this effort to enhance MELCOR capabilities. 
- 16 - 

In addition, the staff continues to be involved in various activities coordinated by the Nuclear 

Energy Agency including research projects dealing with SFP accident phenomenology. The 

staff participated recently in a project focused on the development of phenomena identification 

and ranking table for spent fuel pool accidents. Although the staff’s evaluation is that the use of 

MELCOR in its present state where uncertainties are appropriately considered is sufficient for 

current regulatory applications, it believes that improvements in MELCOR capabilities are 

important and will be pursued in a cost effective manner. 

In conclusion, the staff has evaluated NAS Recommendation 4.6 and concludes that MELCOR 

models the most important severe accident phenomena, is sufficiently supported by appropriate 

experimental validation, and is sufficient for current regulatory applications. The NRC will 

continue to evaluate available information from testing programs, international activities, and 

other sources to validate and improve analysis tools such as MELCOR. Uncertainties in the 

analysis tools will continue to be addressed when they are used to support regulatory decisions. 

Recommendation 4.8: Spent Fuel Dispersal and Remote Cooling Capabilities 

Finding 4.7: The [NRC] has not analyzed the vulnerabilities of spent fuel pools to the specific 

terrorist attack scenarios identified in Recommendation 3E-1 in [NAS 2004].4

Finding 4.8: The [NRC] and the U.S. nuclear industry have made good progress in 

implementing actions to address Recommendation 3E-2 in [NAS 2006]. The [NRC] has 

directed plant licensees to: 

• Reconfigure their spent fuel in pools to achieve at least a 1 × 4 dispersion of high- and 

low-decay-heat assemblies, unless such configuration can be shown to be inapplicable or 

unachievable. This configuration must be achieved following each fuel offload from the 

reactor not later than 60 days after reactor shutdown. 

• Develop guidance and implement strategies to maintain and restore spent fuel pool cooling 

following explosions and fires. To address this requirement, the U.S. nuclear industry has 

developed and adopted guidance and strategies for spent fuel pool water makeup and water 

sprays. 

However, additional work is needed to more fully implement Recommendation 3E-2 in 

[NAS 2006]. 

Recommendation 4.8: The NRC should take the following actions to more fully implement 

Recommendation 3E-2 in [NAS 2006]: 

• Reexamine the need for the 60-day limit for fuel dispersion and reduce the allowable 

time if feasible. 

• Reexamine and, if needed, redesign the water makeup and spray systems and 

strategies to ensure that they can be implemented when physical access to pools is 

hindered or the site becomes inaccessible. 

 

4 A description of the NRC’s assessment and actions related to the previous NAS study are provided in a 

report to Congress issued in March 2005 (ADAMS Accession No. ML050280428).
- 17 - 

NRC Staff Assessment and Planned Actions: 

The staff revisited the issue of spent fuel dispersal and provided its results to the Commission in 

SECY-14-0136, “Response to Commission Direction on Spent Fuel Pool Limited Term 

Operational Vulnerabilities,” dated November 26, 2014. The Commission was informed of the 

staff’s conclusion that SFPs are safe and secure and no additional regulatory action is 

necessary in this area. In addition, the NRC issued orders after the Fukushima accident 

requiring equipment to maintain SFP cooling following a beyond-design-basis event, which 

includes the capability to connect cooling water without accessing the refueling floor. The staff 

is currently conducting inspections at all sites to validate that this capability has been 

established. Additional details on the NRC’s assessments and actions taken are provided 

below. 

In SRM-COMSECY-13-0030, dated May 23, 2014, the Commission directed the staff to: 

...provide an information paper (classified if necessary) to the Commission, 

detailing staff’s views and considerations regarding the treatment of limited term 

operational vulnerabilities associated with the discharge of spent fuel from cores 

into pools and explaining how agency requirements and guidance assure the 

protection of public health, safety and security; if new vulnerabilities or issues are 

identified the staff should promptly inform the Commission... 

The phrase “limited term operational vulnerabilities” refers to the allowable period of time for 

licensees to achieve a dispersed (e.g., a 1 × 4) spent fuel configuration in the SFP following 

discharge from the reactor core, which is stipulated in guidance documents to be 60 days. 

The staff’s assessment of SFP limited term operational vulnerabilities, as described in 

SECY-14-0136, is that current requirements for SFP mitigation measures are sufficient to 

ensure adequate protection of public health and safety, as well as common defense and 

security. In the expedited transfer analysis (COMSECY-13-0030), the staff concluded that the 

risks from potential SFP accidents are a small contributor to the overall risks for public health 

and safety (less than one percent of the Commission’s quantitative health objectives). As 

discussed in that paper, the additional risk associated with the storage of spent fuel assemblies 

in a nondispersed configuration for a limited period of time does not provide a sufficient safety 

benefit to justify proceeding with regulatory action. Additionally, the staff noted that based on an 

assessment of licensee SFP operational practices, licensees generally place spent fuel in a final 

dispersed (e.g., 1 × 4 pattern) configuration before the 60-day limit. 

During the development of COMSECY-13-0030, the staff did not prepare or provide to the 

Commission a cost/benefit assessment of other possible regulatory actions, such as requiring 

alternate loading patterns within a high density pool or requiring enhancements to accident 

mitigation capabilities. For these cases, the staff found that if the major action (expedited 

transfer of spent fuel to dry cask storage) is a marginal safety improvement, similar or lesser 

actions would likewise not provide a substantial safety improvement. 

In addition to preexisting requirements, the NRC required numerous safety improvements after 

the terrorist events of September 11, 2001, and the Fukushima Dai-ichi accident, including the 

additional SFP capabilities required by Order EA-12-049 and Order EA-12-051 (e.g., diverse 

SFP makeup connections and SFP level instrumentation), as discussed previously. These 
- 18 - 

initiatives have enhanced the safety of SFPs. Additionally, after the terrorist events of 

September 11, 2001, the NRC required licensees to put in place supplemental security 

measures. These enhancements help provide a high level of assurance that a terrorist attack 

cannot affect the SFP safety systems. In conclusion, the staff determined that SFPs are safe 

and secure and that no additional regulatory action is necessary at this time. 

As a follow up item to COMSECY-13-0030, the Commission directed the staff to issue an 

information notice (IN) to inform licensees of the potential added safety benefit of adopting a 

1 × 8 configuration. In response to this direction, the NRC issued IN 2014-14, “Potential Safety 

Enhancements to Spent Fuel Pool Storage,” dated November 14, 2014. This IN discussed 

insights from the SFP study (NUREG-2161) regarding an unlikely, beyond-design-basis seismic 

event. The IN emphasized that storing spent fuel in more favorable loading patterns, placing 

fuel in dispersed patterns immediately after core offload, and taking action to improve mitigation 

strategies when the SFP heat load is high may help licensees further reduce the risk associated 

with the SFP. 

In conclusion, the staff has evaluated NAS Recommendation 4.8 and concludes that the 

requirements for cooling capabilities for and dispersion of spent fuel within SFPs adequately 

address the lessons learned from the Fukushima accident. As described in 

COMSECY-13-0030, the staff considered analysis results, operating history, and limited safety 

benefits of possible plant changes and found that further studies as recommended by NAS 

would be unlikely to support additional regulatory requirements related to the storage of spent 

fuel. NAS did not identify any new information that would cause the staff to reconsider the 

conclusions reached in COMSECY-13-0030. The staff is in the process of documenting the 

acceptability of licensees’ plans for mitigating strategies and inspecting each licensee’s 

implementation of the orders related to mitigating strategies and SFP level instrumentation. The 

staff will also continue with the mitigating strategies rulemaking activities. In addition, the NRC 

will continue to inspect and assess licensees’ security programs, work with other Federal 

agencies to assess possible threats, and participate in interagency and international efforts to 

ensure an appropriate level of security is maintained for NRC regulated facilities. 

Recommendation 4.10: ISFSI Security Rulemaking 

Finding 4.10: The [NRC] is incorporating the results of its dry cask vulnerability analyses into 

its regulations through rulemaking. The rulemaking was still in progress when the present study 

was being completed; consequently, the committee was unable to evaluate its technical 

soundness and completeness. 

Recommendation 4.10: The [NRC] should give high priority to completing its analyses on dry 

cask storage vulnerabilities and rulemaking. 

NRC Staff Assessment and Planned Actions: 

The Commission recently decided to extend the schedule to complete a dry cask storage 

security rulemaking. The purpose of the delay is to allow for regulatory and research programs 

to evolve in this area. As discussed in its justification for requesting delay of the rulemaking, the 

staff indicated that existing security regulations, additional requirements provided in security 

orders, and regular security inspections continue to provide high assurance of adequate 

protection of public health and safety. The rulemaking was therefore viewed as a lower priority 
- 19 - 

activity that could be delayed in light of higher priority rulemakings and the agency’s declining 

budget environment. Additional details on the NRC’s assessments and actions taken are 

provided below. 

COMSECY-15-0024, “Proposed Rulemaking on Security Requirement for Facilities Storing 

Spent Nuclear Fuel and High-Level Radioactive Waste,” dated September 11, 2015, provides 

the staff’s technical approach, and updated recommendation on the timeline for a proposed rule 

to develop security requirements for facilities providing interim storage of spent nuclear fuel and 

high-level radioactive waste. This was in response to previous Commission direction to pursue 

rulemaking in this area. Because of developments in the nuclear industry since the issuance of 

SRM-SECY-10-0114 and the SRM to an earlier paper, SECY-07-0148, “Independent Spent 

Fuel Storage Installation Security Requirements for Radiological Sabotage,” the staff 

recommended delaying this security rulemaking for up to 5 years. 

The recent number of power reactors permanently ceasing operations, in part, has prompted 

the Commission to direct the staff to conduct rulemaking to govern the transition of power 

reactors to decommissioning. The staff’s evaluation of resources and expertise necessary to 

support both the decommissioning and ISFSI security rulemakings revealed additional interface 

issues warranting further consideration, including when a dose-based regulatory approach for 

ISFSIs should be implemented during the facility’s life cycle. 

Concurrently, the environment for spent fuel storage and disposal continues to evolve. Aside 

from ISFSIs, the staff has received one application (Waste Control Specialists) to construct an 

interim consolidated spent fuel storage facility and expects to receive another in 2017. Although 

the staff remains confident that existing requirements ensure adequate protection, construction 

and operation of these facilities, if licensed, will require the staff to reexamine potential security 

scenarios to support the technical basis for the subject rulemaking. 

Although the agency continues to evaluate the appropriate approach for this rulemaking, the 

existing security regulations for ISFSIs, together with the additional requirements in the security 

orders issued after September 11, 2001, provide continued high assurance of adequate 

protection of public health and safety regardless of the license type or location. Additionally, 

triennial security inspections for ISFSIs ensure industry compliance with all current 

requirements. Not pursuing the subject rulemaking would leave in place two different but 

acceptable licensing approaches for security of ISFSIs, general and specific. The staff does not 

currently plan to accelerate the timeline to initiate the rulemaking within 5 years. However, the 

staff may conduct a technical review sooner, if necessitated by external factors. 

In conclusion, the staff has evaluated NAS Recommendation 4.10 and concludes that it is not 

necessary to reprioritize or reschedule activities related to the ISFSI security rulemaking. The 

staff will continue to pursue improvements in the regulatory and research programs related to 

the security of dry cask storage facilities. The rulemaking activity will benefit from these insights 

and will be completed in accordance with the priorities and schedules established by the 

Commission. 
- 20 - 

Recommendation 4.11: Spent Fuel Storage Risk Assessment 

Finding 4.11: The [NRC] has completed a technical analysis of [SFP] accident consequences 

to inform a regulatory decision on expedited transfer of spent fuel from pool to dry cask storage. 

The analysis was carried out in accordance with prescribed [NRC] regulatory guidance and 

provides valuable technical information about the effects of various accident scenarios on spent 

fuel storage in pools. However, the analysis did not consider spent fuel storage sabotage risks, 

dry cask storage risks, or certain health consequences that would likely result from a severe 

nuclear accident. The analysis also used simplifying bounding assumptions that make it 

technically difficult to assign confidence intervals to the consequence estimates or make valid 

risk comparisons. A risk assessment that evaluates the three questions of the risk triplet and 

that accounts for uncertainties in both probability and consequence estimates is needed to 

address Finding 4E in [NAS 2006] to determine whether “earlier movements of spent fuel from 

pools into dry cask storage would be prudent to reduce the potential consequences of terrorist 

attacks on pools at some commercial nuclear plants.” 

Recommendation 4.11: The [NRC] should perform a spent fuel storage risk assessment to 

elucidate the risks and potential benefits of expedited transfer of spent fuel from pools to dry 

casks. This risk assessment should address accident and sabotage risks for both pool and dry 

storage. The sabotage risks should be assessed using the methodology developed in response 

to the present committee’s Recommendation 4.1B. 

NRC Staff Assessment and Planned Actions: 

As previously discussed, the NRC has performed or sponsored a number of studies of spent 

fuel storage, for both SFPs and dry cask storage. Relatively recent studies have included an 

evaluation of BWR SFPs in NUREG-2161 and dry cask storage in NUREG-1864, “A Pilot 

Probabilistic Risk Assessment of a Dry Cask Storage System at a Nuclear Power Plant.” The 

staff is continuing to gather regulatory and technical insights on the security of dry cask storage 

for use in a planned rulemaking related to that topic. As noted earlier, the Commission has 

dispositioned the issue of expedited transfer of spent fuel from SFPs to dry casks and decided 

that the agency should not pursue this matter given the thorough analyses that have been done. 

The staff will also continue to cooperate with other Federal agencies and international bodies to 

assess security threats and take action if appropriate. Additional details on the NRC’s 

assessments and actions taken are provided below. 

The accident at the Fukushima Dai-ichi nuclear facility in Japan led to additional questions 

about the safe storage of spent fuel and whether the NRC should require the expedited transfer 

of spent fuel from SFPs to dry cask storage at nuclear power plants in the United States. This 

issue was identified by staff as needing further study to determine if regulatory action was 

warranted. On October 9, 2013, the NRC released the study later published as NUREG-2161 

and on November 12, 2013, the NRC delivered a regulatory analysis to the Commission in 

COMSECY-13-0030. These documents concluded that SFPs are very robust structures with 

large safety margins, and that proposed regulatory actions for SFP safety improvements were 

not warranted. Citing the low risk to public health and safety from SFP storage, the Commission 

subsequently concluded that regulatory action need not be pursued in 

SRM-COMSECY-13-0030. 
- 21 - 

The main issue that NAS raises is whether the staff appropriately considered all of the factors 

that should be evaluated in a thorough analysis of a proposed regulatory action. The analysis 

methods are specified by various guidance documents. The two documents that govern the 

NRC’s regulatory analysis process are NUREG/BR-0058, Revision 4, “Regulatory Analysis (RA) 

Guidelines of the NRC,” dated September 2004 (RA Guidelines), and NUREG/BR-0184, 

“Regulatory Analysis Technical Evaluation Handbook,” dated January 1997 (RA Handbook). 

These documents are the well-established, Commission-approved directives for identifying all 

attributes affected by the proposed alternative and analyzing them either quantitatively or 

qualitatively. The staff followed this guidance when conducting the regulatory analysis 

contained in COMSECY-13-0030. 

In COMSECY-13-0030, the staff used bounding or conservative values in the analysis for 

several parameters, particularly in the high estimate cases, to ensure that design, operational, 

and other site variations among the new and operating reactor fleet were addressed and to 

generally increase the calculated benefits from the proposed action. This approach does differ 

from analyses undertaken to provide best estimate characterizations of risks but proved 

sufficient for the regulatory decisions needing to be made by the NRC. The staff does not agree 

that further analysis of the factors recommended by NAS would have resulted in a different 

conclusion or is needed to provide further support of the decisions made. 

The staff’s analysis in COMSECY-13-0030 and the supporting references did not include events 

caused by sabotage. Security issues were extensively assessed in various studies and 

regulatory analyses following the terrorist attacks of September 11, 2001, and enhanced 

security requirements were imposed to provide high assurance of adequate protection from 

radiological sabotage of the nuclear power plant reactor and SFP. The NRC did not include 

sabotage in the COMSECY-13-0030 analysis as it was determined that these types of security 

issues were previously addressed and resolved. Plant security is one of many topics within the 

NRC’s risk-informed, performance-based framework that are assessed in combination with but 

not fully integrated into PRA models. The NRC continually monitors threat conditions and 

should any new or significant security concerns arise that may require regulatory action, the 

NRC will make adjustments, as appropriate, in the governing security requirements to ensure 

their effective implementation. 

In performing economic analyses, such as that contained in COMSECY-13-0030, the NRC 

considers public health, occupational health, environmental considerations, and two categories 

of property—onsite and offsite. Generally, onsite property is owned or controlled by the licenseor certificate-holder and located within the boundaries of the licensed facility, whereas offsite 

property is located outside of the site boundaries, and is not owned or controlled by the licenseor certificate-holder. However, in these economic analyses, the distinction between offsite and 

onsite property goes beyond the location or ownership of the property. Onsite property costs 

include replacement power, decontamination costs, and costs associated with refurbishment or 

decommissioning. Offsite property costs include both the direct costs associated with property 

damage (e.g., diminution of property values) and indirect costs (e.g., tourism, manufacturing, 

and agriculture disruption). 

However, there are limits based on considerations of health, safety, or property damage that is 

too far attenuated from NRC authority under the Atomic Energy Act (AEA). For example, in 

Metropolitan Edison Co. v. People against Nuclear Energy, 678 F.2d 222 (D.C. Cir. 1982), the 

U.S. Court of Appeals for the D.C. Circuit evaluated the reach of the AEA in providing protection 
- 22 - 

against radiological harm. Specifically, the D.C. Circuit ordered the Commission to study the 

“alleged psychological health impacts arising from the proposed restart” under the National 

Environmental Policy Act and, with respect to the AEA, “to submit to the court a statement of 

[the Commission’s] reasons for concluding that the [AEA] did not require consideration of 

psychological health in the restart proceeding.” On March 30, 1982, the Commission complied 

with the court’s order by filing a Memorandum and Order, in which the Commission determined 

that consideration of psychological effects was not intended under the AEA, as there was no 

precedent in establishing a requirement that “health and safety” in Sections 2 and 103 of the 

AEA be interpreted to include psychological health.5 The D.C. Circuit upheld the Commission’s 

Memorandum and Order regarding the AEA, stating that it agreed with the Commission’s 

decision “not to consider psychological stress issues under the AEA,” 678 F.2d at 250. See 

SECY-12-0110, “Consideration of Economic Consequences within the U.S. Nuclear Regulatory 

Commission’s Regulatory Framework,” dated August 14, 2012, for further discussion of AEA 

case law suggesting limits to the Commission’s discretion. 

In terms of more fully accounting for uncertainties in scenario probabilities and consequences, 

the staff agrees that quantifying uncertainty is a best practice, which is addressed in many 

guides and references. The explicit identification and quantification of sources of uncertainty in 

regulatory analyses leads to better decisionmaking by providing a means to understand this 

uncertainty (e.g., the effect of data, assumptions, accident frequency, and consequence), effect 

of variations within different regulatory analysis groupings (e.g., categories of licensees), and 

the potential range of incremental costs and benefits that result. However, resource and 

scheduling limitations may necessitate using limited scope or historical PRA studies as bases 

for evaluating the effect of regulatory alternatives. 

Furthermore, the Commission has directed that the staff improve its methods of quantitative 

analysis, including the treatment of uncertainty to support the development of realistic estimates 

of the costs of implementing proposed requirements (SRM-SECY-14-0087, “Staff 

Requirements – SECY-14-0087 – Qualitative Considerations of Factors in the Development of 

Regulatory Analysis and Backfit Analysis,” dated March 4, 2015). The staff is developing 

guidance for implementing the Commission’s direction. This guidance will address qualitative 

factors assessment methodology, cost estimating best practices, and the treatment of 

uncertainty in regulatory and backfit analyses. 

In conclusion, the staff has evaluated NAS Recommendation 4.11 and concludes that the 

various analyses performed or sponsored by the NRC have been sufficient to support regulatory 

decisions on the safety and security of spent fuel pools. The staff is continuing to gather 

regulatory and technical insights on the security of dry cask storage for use in a planned 

rulemaking related to that topic. The staff will also continue to cooperate with other Federal 

agencies and international bodies to assess security threats and take action if appropriate. 

 

5 Metropolitan Edison Co., CLI-82-6, 15 NRC 407 (1982).