UNITED STATES 

NUCLEAR REGULATORY COMMISSION 

WASHINGTON, D.C. 20555-0001 

October 5, 2016 

SECRETARY 

COMMISSION VOTING RECORD 

DECISION ITEM: 

TITLE: 

SECY-16-0073 

OPTIONS AND RECOMMENDATIONS FOR THE FORCE-ONFORCE INSPECTION PROGRAM IN RESPONSE TO 

SRM-SECY-14-0088 

The Commission acted on the subject paper as recorded in the Staff Requirements 

Memorandum (SRM) of October 5, 2016. 

This Record contains a summary of voting on this matter together with the individual vote 

sheets, views and comments of the Commission. ) 

~\12],J-V 

Enclosures: 

1. Voting Summary 

2. Commissioner Vote Sheets 

cc: Chairman Burns 

Commissioner Svinicki 

Commissioner Baran 

OGC 

EDO 

PDR 

Annette L. Vietti-Cook 

Secretary of the Commission 
VOTING SUMMARY- SECY-16-0073 

RECORDED VOTES 

NOT 

APPROVED DISAPPROVED ABSTAIN PARTICIPATING COMMENTS DATE 

Chrm. Burns x x 08/18/16 

Cmr. Svinicki x x x 09/19/16 

Cmr. Baran x x x 07/19/16 
TO: 

FROM: 

SUBJECT: 

NOTATION VOTE 

RESPONSE SHEET 

Annette Vietti-Cook, Secretary 

Chairman Burns 

SECY-16-0073: OPTIONS AND RECOMMENDATIONS 

FOR THE FORCE-ON-FORCE INSPECTION 

PROGRAM IN RESPONSE TO SRM-SECY-14-0088 

Approved X Disapproved Abstain Not Participating 

COMMENTS: Below 

Entered in STARS 

Yes x 

--

No 

-- -- --

Attached X None 

a tu re 

August 2016 
Chairman Burns's Comments on SECY-16-0073 

Options and Recommendations for the Force-on-Force 

Inspection Program in Response to SRM-SECY-14-0088 

I appreciate the NRC staff's efforts to address the Staff Requirements Memorandum (SRM) to 

SECY-14-0088, "Proposed Options to Address Lessons-Learned Review of the NRC's Force-onForce Inspection Program in Response to Staff Requirements COMGEA/COMWC0-14-0001 ." In 

SRM-SECY-14-0088, the Commission approved the staffs recommendation to establish a working 

group to determine how to better integrate knowledge of adversary training methodologies and 

actual attacks with the tactics, techniques, and procedures (TTPs) used by the NRC composite 

adversary force (CAF). The Working Group found that the NRC has successfully integrated 

knowledge of adversary training methodologies and actual attacks with the TTPs used by the CAF 

during NRG-conducted Force-on-Force (FOF) exercises and that the TTPs are consistent with the 

design basis threat and real-world threat information on terrorist training and attack 

methodologies. The Working Group recommended that no changes be made to the TTPs used by 

the CAF during NRG-conducted FOF exercises. Based on these findings, I approve the staff's 

recommendation to terminate the working group and conduct any necessary follow-on activities 

within the program offices. 

Along with its analysis of the Working Group's report, the staff also considered comments 

submitted by the Union of Concerned Scientists and the Nuclear Energy Institute (NEI) on the 

security inspection program. Based on its analysis of these documents, the staff identified two 

options for the Commission's consideration: (1) maintain the current program with incremental 

improvements to guidance or (2) conduct an assessment of the security baseline inspection 

program, including FOF. The staff recommended the second option. In my subsequent dialogue 

with staff management regarding its recommendation, it was clear to me that staff did not intend to 

look at redesigning the program from scratch, but that. it did believe that the opportunity to look 

more broadly at the current FOF program (instituted more than a decade ago) would likely yield 

improvements and efficiencies and that latitude from the Commission in approving Option 2 would 

allow it to do so. 

In addition to the staff's paper and input from external stakeholders, I have also considered the 

vote issued by former Commissioner Ostendorff on SECY-16-0073 and, although he did not 

support Option 2, he did suggest that the staff evaluate two issues with regard to the FOF 

program. Those issues are: 

1. Evaluate how vulnerability assessments could be used to evaluate the effectiveness of 

licensee protective strategies, and whether credit could be given for operator actions or for 

the use of additional equipment such as "flex equipment," which was installed to enhance 

safety but can also provide a security benefit. 

2. Evaluate whether the NRC should provide any credit for local state or federal law 

enforcement response to establish coping time for security events. For example, if a 

licensee engages with state and local law enforcement to conduct site familiarization tours 

and site security exercises, could the staff give credit for integrated response capability in 

establishing the required coping time for a security event? 

The staff should include these issues in its evaluation to determine whether crediting of operator 

actions, the use of FLEX equipment, or response by local, state, or federal law enforcement could 

make the FOF exercises more realistic. 

I had the opportunity to observe a recent FOF exercise and discuss the FOF program with both the 

NSIR team conducting the exercise and the licensee. This experience confirmed my impression 
that the current FOF program overall is sound, but that there are likely improvements that can 

be made to ensure we are focusing our security inspection resources wisely. Therefore, I 

approve Option 2. While I do not believe that a wholesale reconsideration of the program is 

necessary, I believe that there are worthwhile improvements that could be made that go beyond 

incremental improvements to guidance documents. 

The staff should perform a holistic review of the security inspection program , considering both 

internal and external feedback, to identify potential changes that can provide efficiencies while 

maintaining an appropriate level of regulatory oversight that takes into account the maturity of 

the current security inspection program. The staff should submit a notation vote paper to the 

Commission within 12 months from the date of the SRM for SECY-16-0073 which would include 

recommendations on improvements to the security inspection program. The staff should 

continue its dialogue with external stakeholders as part of its evaluation. 

I would also like to mention one specific industry-proposed change to the current FOF program. 

This is the industry proposal that, rather than NRC conducting FOF exercises, the NRC should 

instead observe and evaluate licensee conducted FOF exercises similar to how the NRC 

oversees biannual emergency preparedness exercises. Although there may be some merit to 

this concept, the language requiring FOF exercises in Section 1700 of the Atomic Energy Act of 

1954, as amended, arguably creates challenges for implementation of this proposal. Therefore, 

to the extent that staff intends to address this as part of their overall evaluation, any further staff 

assessment of this industry proposal should be informed by a complete legal analysis from the 

Office of the General Counsel (OGC) on this matter. The legal analysis provided by OGC to the 

staff should also be provided to the Commission. 

Lastly, in his vote, Commissioner Ostendorff also discussed the notion of "high assurance of 

adequate protection" found in our security regulations in 10 CFR Part 73. Reflecting back on 

my time in the General Counsel's office in the years following the terrorist attacks of September 

11 , it was always my understanding that the concept of "high assurance" (first introduced into 

the regulatory vernacular in the 1979 Physical Protection Upgrade rule) did not establish a 

"higher" or more "risk averse" standard as it applies to security than the NRC has with regard to 

how it regulates safety. The regulatory history cited by Commissioner Ostendorff has always, in 

my view, reflected that "high assurance" is equivalent to "reasonable assurance" when it comes 

to determining what level of regulation is appropriate. In other words, and as I have attempted 

to articulate many times during my tenure, the NRC should not be applying a "zero risk" 

mentality to security any more than we should be doing so with respect to safety. Therefore, 

when the staff is implementing the NRC's regulatory program, either in developing new 

regulations, inspecting licensee compliance with regulations, or executing the FOF program, I 

urge the staff to be mindful of our regulatory mandate. 
TO: 

FROM: 

SUBJECT: 

NOTATION VOTE 

RESPONSE SHEET 

Annette Vietti-Cook, Secretary 

COMMISSIONER SVINICKI 

SECY-16-0073: OPTIONS AND RECOMMENDATIONS 

FOR THE FORCE-ON-FORCE INSPECTION 

PROGRAM IN RESPONSE TO SRM-SECY-14-0088 

Approved XX In-part Disapproved XX In-part Abstain __ 

Not Participating __ 

COMMENTS: Below Attached XX None --

09/ /1/16 

DATE 

Entered on "STARS" Yes _L'No _ 
Commissioner Svinicki's Comments SECY-16-0073 

Options and Recommendations for the Force-on-Force Inspection Program 

in Response to SRM-SECY-14-0088 

In this paper, the staff requests approval to: 1) conduct an assessment of the security baseline 

inspection program, including force-on-force (FOF) (termed Option 2, by the staff), and 2) 

terminate the NRC Working Group formed at the Commission's direction to assess the tactics, 

techniques , and procedures (TTPs) used by the NRC composite adversary force (CAF). I 

approve termination of the working group and direction that the group's findings and any followon activities be addressed through the program offices. I approve the staff's proposal to 

conduct an assessment of the security baseline inspection program , including FOF, as limited 

and conditioned by the comments contained in this vote. Prior to ending his term of service on 

the Commission earlier this year, Commissioner Ostendorff provided his views on this paper. 

Although I am not specifically in alignment with each of his views, I wil l make reference to some 

of them here and therefore I attach his written vote commentary (although not binding on this 

deliberation) to my vote, for ease of reference. 

In implementing the assessment called for in the staff's Option 2, the staff should avoid 

attempting a fundamental redesign of the program. Rather, the staff should conduct a review 

limited to those areas that are the most likely to yield improvements and efficiencies. Three 

issues specifically suggested by Commissioner Ostendorff should be included. Paraphrased 

somewhat, they are as follows: 

1. Evaluate how vulnerabil ity assessments could be used to determine the effectiveness of 

licensee protective strategies and whether credit could be given for operator actions or 

for the use of additional equipment such as FLEX equipment, which was installed to 

enhance safety but can also provide a security benefit. 

2. Evaluate whether the NRC should provide any credit for local, State, or Federal law 

enforcement response to establish coping time for security events. For example, if a 

licensee engages with State or local law enforcement to conduct site familiarization tours 

and site security exercises, should the staff give credit for integrated response capabil ity 

in establishing the required coping time for a security event? 

3. Evaluate whether the NRC's historical application of the backfit rule for safety-related 

matters should find some analogue in security decision-making in order to provide a 

measure of greater finality and regulatory stability to our security framework. 

In evaluating these issues, the staff should attempt to establish whether crediting operator 

actions; the use of FLEX equipment; or response by local, State, and Federal law enforcement 

would make the FOF exercises challenging but more realistic and if so, how. Areas of 

examination, such as these, have the potential to provide incremental and worthwhile 

improvements. 

I agree that the NRC's baseline and FOF inspection programs are mature and well-understood. 

Consequently, the staff's more limited Option 2 assessment should be completed and a notation 

vote paper provided to the Commission within 12 months from the date of the staff requirements 

memorandum on this paper. A Commission decision on this future paper, coupled with the 

Commission's existing decision to review and approve any proposed staff revisions to 

Regulatory Guides 5.69, "Guidance for the Application of Radiological Sabotage Design-Basis 

Threat in the Design, Development and Implementation of a Physical Security Program that 

Meets 10 CFR 73.55 Requirements" and 5.77, "Insider Mitigation Program ," will make 

substantial headway in re-affirming the alignment between the staff's day-to-day implementation 
- 2 

of the security framework and the Commission's standing policies in this area. I agree with 

former Commissioner Ostendorff that the "Commission is responsible for establishing the 

Design Basis Threat (DBT) and approving any proposed changes to the DBT based on the 

threat environment" and "has the ability to view safety and security protections as one integrated 

regime that assures adequate protection of public health and safety." For these reasons, 

Commission-level review and approval of these associated regulatory guides does not reflect a 

lack of confidence in the staff's work but rather reflects a needed intermittent val idation of this 

alignment. As such, Commission review is both needed and appropriate. 

I specifically disapprove the creation of a new NRC guidance document to house operating 

experience associated with the FOF program. Such operating experience is more traditionally 

and effectively housed in and disseminated through industry guidance, endorsed by the NRC. 

Consequently, FOF operating experience, to the extent not documented elsewhere, is likely 

best consolidated into existing industry guidance documents. 

Finally, I add my understanding of the agency's history of "high assurance" of adequate 

protection with respect to NRC's security regulations in 10 CFR Part 73. My understanding of 

the history of this issue is entirely consistent with that of Chairman Burns and former 

Commissioner Ostendorff, namely, that the concept of "high assurance" does not and was not 

intended to differ fundamentally from the rubric of "reasonable assurance of adequate 

protection" applied to the broad category of safety concerns dispositioned by the NRC under the 

Atomic Energy Act, as amended. Thus, our standard for security is the same as our standard 

for safety - "reasonable assurance of adequate protection" - not higher assurance, or zero risk, 

and the Commission sets the guideposts for how this standard is achieved through exercising 

its policymaking role. The staff should operate under this paradigm and eliminate ambiguity on 

this point in its guidance documents or other internal directives, instructions, or training 

materials, to the extent such ambiguity exists. 

Enclosure: Commissioner Ostendorff's 

comments on SECY-16-0073 

/16 
Enclosure to Commissioner Svinicki's vote on SECY-16-0073 

Commissioner Ostendorffs Comments on SECY-16-0073: 

"Options and Recommendations for the Force-On-Force Inspection Program in 

Response to SRM SECY 14-0088" 

It is my intent in this vote to share with the staff and my fellow Commissioners my thoughts on 

security regulatory matters in a broad context rather than limit my comments to the specific 

matters discussed in SEGY-16-0073. 

As discussed in GOMWG0-14-0001/GOMGEA-14-0001, and subsequently in my vote on 

SECY-14-0088, the current force-on-force program has been in place for twelve years, and 

significant security enhancements have been implemented by licensees since the terrorist 

attacks of September 11, 2001. I have confidence through our licensing and oversight 

programs that commercial nuclear power facilities are protected by robust security measures. 

A Commission-directed lessons-learned review of the force-on-force program was initiated in 

2014 and resulted in enhancements and clarifications to the force-on-force program in several 

areas. These areas include the timing of compensatory measures and the realistic ability to 

exploit unattended openings. Other staff-initiated changes were implemented over the past two 

years including reducing the number of exercises during triennial force-on-force inspections 

from three to two, increasing notification time for force-on-force inspections to allow more 

effective resource planning, and enhancing the significance determination process for security. 

I applaud the staff's actions in these areas. 

Recently, industry has suggested reducing the number of force-on-force exercises from two to 

one. I do not support this proposal. While this could result in some resource savings, it could 

also introduce challenges if the exercise is indeterminate due to controller issues or must be 

cancelled due to inclement weather or other unforeseen circumstances. The staff should 

evaluate a change to the force-on-force program wherein the staff would plan two exercises and 

establish criteria to permit the staff to cancel the second exercise if the licensee demonstrates 

an effective protective strategy in the first exercise and has no significant performance 

deficiencies in the security cornerstone. On a related matter, it is important to note that forceon-force exercises are designed to be very challenging and that a "failed" force-on-force 

exercise does not necessarily indicate that a licensee's protective strategy is ineffective or 

noncompliant. Any performance deficiencies identified during the force-on-force inspection or 

other security inspections must be appropriately evaluated through the significance 

determination process. The need for changes to a licensee's protective strategy in response to 

inspection findings must be evaluated carefully in the context of the licensing basis and backfit 

considerations. 

I am also opposed to industry's suggestion that the NRG observe licensee-conducted force-onforce exercises in lieu of NRG-conducted force-on-force exercises. This should not be viewed 

as criticism of licensee efforts. Rather, NRG-conducted force-on-force exercises have an 

important role in the public confidence in physical security programs and are mandated by 

Page 1of3 
legislation. Furthermore, NRG-conducted force-on-force exercises establish a consistent and 

structured framework to fulfill the agency's regulatory responsibilities. 

As a Commissioner, my votes have been grounded in the NRC's longstanding regulatory 

framework of adequate protection and the application of the backfit rule. I have also been 

guided by the principles of good regulation. Consistent with our principles of good regulation, 

regulatory activities should be consistent with the degree of risk reduction they achieve, and 

once established should be perceived as reliable and not unjustifiably in a state of transition. In 

that context, in my deliberations on safety matters, I ask the questions: "What problem are we 

trying to fix?" and "How safe is safe enough?" As I read SECY-16-0073, and as I listened to 

discussions during a recent Commission meeting on related topics, I was struck that we must 

exercise the same degree of discipline in regulatory decisions on security matters as we do on 

safety matters and ask similar questions: "What problem are we trying to fix?" and "How secure 

is secure enough?" 

I would also like to provide some context for the Commission's recent direction to the staff in 

SRM-M 160623 to provide proposed revisions to Regulatory Guides 5.69, "Guidance for the 

Application of Radiological Sabotage Design-Basis Threat in the Design, Development and 

Implementation of a Physical Security Program that Meets 10 CFR 73.55 Requirements" and 

5.77, "I nsider Mitigation Program," to the Commission for review and approval. The 

Commission is responsible for establishing the Design Basis Threat (DBT) and approving any 

proposed changes to the DBT based on the threat environment. To fulfill this obligation, the 

Commission has access to current intelligence information through frequent briefings and 

interactions with federal law enforcement and intelligence agencies. The Commission also has 

awareness of the broader context of security requirements within the NRC's regulatory 

framework, and therefore has the ability to view safety and security protections as one 

integrated regime that assures adequate protection of public health and safety. For these 

reasons, proposed revisions to the DBT and associated regulatory guides should be subject to 

Commission-level review and approval. 

Further reinforcing this direction, I will note that there is scant explanation in our regulatory 

history of the basis for the standard of "high assurance" used in Part 73 to ensure adequate 

protection of public health and safety. It is the Commission's responsibility to provide direction 

to the staff, and this vote paper offers an appropriate means to clarify what "high assurance" is. 

Through discussions with senior NRC staff and review of the Part 73 statements of 

consideration, it is my understanding that when it introduced the term "high assurance," the 

Commission did not intend to establish a separate standard for security regulations. Instead, as 

explained in 1979, when the Commission updated Part 73 and revised its "high assurance" 

objective in the performance of security systems, the Commission explained that "'reasonable 

assurance,' commonly used in safety evaluations, is applied to a broad category of safety 

concerns . .. . [T]he degree of assurance necessary to provide 'reasonable assurance' varies 

with the gravity of the safety concern." 44 Fed. Reg. 68, 184, 68, 185 (Nov. 28, 1979). Thus, the 

regulatory standard for security is the same as the regulatory standard for safety-reasonable 

Page 2 of 3 
assurance of adequate protection of public health and safety-and the Commission sets the 

standard. 

I will now turn to the use of quantitative analysis to evaluate regulatory changes on security 

matters. I recognize that tools such as probabilistic risk assessment are more easily applied to 

regulatory decisions in the safety arena. However, the same regulatory framework and backfit 

provisions apply to both safety and security requirements. Any proposed changes to security 

requirements and guidance should be supported by thorough regulatory analysis and 

quantitative analysis to the extent practical. Vulnerability assessment tools may be of use to 

evaluate proposed regulatory requirements and to assess licensees' protective strategies, for 

example the size of the licensees' protective force. 

Finally, with regard to the specific recommendations in SECY-16-0073, I approve the staff's 

proposal in Option 1 to terminate the Tactics, Techniques, and Procedures Working Group. All 

follow-on activities from the Working Group and the direction received from the Commission 

should be conducted by the program offices . Regarding Option 2, the staff has not made it 

clear what problem they are trying to fix, what the expected outcomes are, and what resources 

would be required. In the current budgetary environment we cannot spend resources on new 

projects without a clear understanding of the objective. Therefore, I disapprove Option 2. 

Instead of Option 2, the staff should evaluate the following issues and provide a notation vote 

paper discussing any proposed actions: 

1. Evaluate how vulnerability assessments could be used to evaluate the effectiveness of 

licensee protective strategies, and whether credit could be given for operator actions or 

for the use of additional equipment such as "flex equipment," which was installed to 

enhance safety but can also provide a security benefit. 

2. Evaluate whether the NRC should provide any credit for local state or federal law 

enforcement response to establish coping time for security events. For example, if a 

licensee engages with state and local law enforcement to conduct site familiarization 

tours and site security exercises, could the staff give credit for integrated response 

capability in establishing the required coping time for a security event? 

3. Evaluate the NRC's historical application of the backfit rule to security decision-making 

and whether additional guidance is needed in this area regarding the ability to quantify 

the benefit of security enhancements. 

Page 3 of 3 
TO: 

FROM: 

SUBJECT: 

NOTATION VOTE 

RESPONSE SHEET 

Annette Vietti-Cook, Secretary 

Commissioner Baran 

SECY-16-0073: OPTIONS AND RECOMMENDATIONS 

FOR THE FORCE-ON-FORCE INSPECTION 

PROGRAM IN RESPONSE TO SRM-SECY-14-0088 

Approved X Disapproved X Abstain Not Participating - -

COMMENTS: Below 

Entered in STARS 

Yes XX 

No 

Attached X None 

Date 
Commissioner Saran's Comments on SECY-16-0073, "Options and Recommendations 

for the Force-on-Force Inspection Program in Response to SRM-SECY-14-0088" 

I appreciate the efforts of NRC's Force-on-Force (FOF) Tactics, Techniques, and 

Procedures (TTPs) Working Group, which found that the TTPs used by the NRC composite 

adversary force in FOF exercises are consistent with both NRC's design-basis threat and the 

TTPs of actual terrorist groups. With its report complete, I approve the staff's recommendation 

to terminate the Working Group. 

I also approve Option 1 - to maintain the current FOF inspection program while making 

incremental improvements through the normal self-assessment process. I do not believe it is 

necessary to conduct a comprehensive assessment of the security inspection program at this 

time, particularly in light of the staff's acknowledgement that the significant resources expended 

on such an assessment "might result in only limited improvements to the security program." In 

addition, some of the potential initiatives being discussed in the context of a broad assessment 

could weaken the FOF program. For example, I do not support the use of novel performance 

metrics that are not tied to the Security Cornerstone of the Reactor Oversight Process. I also do 

not support reducing the number of exercises conducted during NRC's triennial FOF 

inspections. 

However, there are two specific elements of the security inspection program that the 

NRC staff should examine further. First, in future self-assessments, the staff should evaluate 

the licensee Insider Mitigation Program, an increasingly important aspect of the security 

inspection program that has not been assessed recently. Second, within six months of the Staff 

Requirements Memorandum resulting from this paper, the staff should provide an information 

paper to the Commission on the status of and next steps for facilitating an integrated response 

by site security and law enforcement to security threats at licensee facilities.