POLICY ISSUE 

Information

February 25, 2016 SECY-16-0018 

FOR: The Commissioners 

FROM: Victor M. McCree 

Executive Director for Operations 

SUBJECT: STATUS OF IMPROVEMENTS TO THE FORCE-ON-FORCE 

INSPECTION PROGRAM IN RESPONSE TO SRM-SECY-14-0088 

PURPOSE: 

The purpose of this paper is to provide the Commission with an update on the status of the 

staff’s commitments in SECY-14-0088, “Proposed Options to Address Lessons-Learned Review 

of the U.S. Nuclear Regulatory Commission’s Force-on-Force Inspection Program in Response 

to Staff Requirements Memorandum – COMGEA/COMWCO-14-0001,” (Agencywide 

Documents Access and Management System (ADAMS) Accession Number ML14139A215). 

This paper also addresses the Commission-directed actions on the Multiple Integrated Laser 

Engagement System (MILES) and unattended openings (UAOs) from SRM-SECY-14-0088, 

“Staff Requirements – SECY-14-0088 – Proposed Options to Address Lessons-Learned Review 

of the NRC’s Force-on-Force Inspection Program in Response to Staff Requirements 

COMGEA/COMWCO-14-0001” (ADAMS Accession Number ML1435A433). This paper does 

not address any new commitments or resource implications. 

SUMMARY: 

In SECY-14-0088, the staff committed to take several actions, including: 

1. Continuing to work with industry to review and reduce the number of extensive 

simulations used in developing and executing force-on-force (FOF) scenarios by 

identifying, validating, and benchmarking mechanisms, such as the use of simulation 

software, to evaluate potential vulnerabilities that may be inappropriate for performance 

testing during an NRC-conducted FOF exercise; 

CONTACT: Michael Layton, NSIR/DSO 

(301) 287-3664 
The Commissioners -2- 

2. Reviewing and updating the physical protection significance determination process 

(SDP); 

3. Issuing a generic communication to licensees to clarify the U.S. Nuclear Regulatory 

Commission’s (NRC’s) expectations regarding the implementation of compensatory 

measures; and 

4. Enhancing guidance, training, and inspection program documents in the effort to 

improve the realism and effectiveness of FOF exercises. 

Consistent with Commission’s direction, the staff has made progress on all of the commitments 

identified in SECY-14-0088. Specifically, the staff is working to understand the capabilities and 

limitations of simulation software and how these software tools can be used to evaluate 

potential vulnerabilities that may be inappropriate for performance testing during an NRCconducted FOF exercise. The staff is also working to update the physical protection SDP and 

has included opportunities for stakeholder comment during the development of the SDP 

revisions. The staff developed a draft Regulatory Issue Summary (RIS) on compensatory 

measures, “Clarification on the Implementation of Compensatory Measures for Protective 

Strategy Deficiencies or Degraded or Inoperable Security Systems, Equipment, or 

Components,” which will be issued for public comment in the first quarter of calendar year (CY) 

2016. The staff has made updates to the FOF notification and inspection preparation process 

and is evaluating other enhancements to guidance, training, and inspection procedures to 

improve the realism and effectiveness of FOF exercises. 

In SRM-SECY-14-0088, the Commission directed the staff to establish an NRC working group 

to determine how to better integrate knowledge of adversary training methodologies and actual 

attacks with the tactics, techniques, and procedures (TTPs) used by the NRC composite 

adversary force (CAF). The Commission also directed the staff to conduct a review of the 

MILES software and to evaluate the NRC’s requirements for UAOs. The staff formed a FOF 

TTP Working Group (hereafter referred to as the Working Group). Findings and 

recommendations based on the results of the Working Group’s effort will be reported to the 

Commission in a notation vote paper in June 2016. Additionally, the staff has completed its 

review of the MILES equipment and software. Based on this review, the staff has decided not to 

restore the software to its original configuration. Finally, the Working Group completed its 

review of the NRC’s UAO requirements and issued an update to the SDP for UAOs. This SDP 

update takes into account the realistic ability for specific opening configurations to be exploited 

when evaluating inspection findings and assessing licensee corrective actions. 

DISCUSSION: 

In accordance with the Commission’s direction, this paper provides the status of the staff’s 

actions on the four commitments outlined above, as well as the status of the staff’s efforts on 

MILES and UAOs. 

Simulation Software 

In SECY-14-0088, the staff committed to work with industry to identify, validate, and benchmark 

mechanisms, such as the use of simulation software, to evaluate potential vulnerabilities that 

may be inappropriate for performance testing during an NRC-conducted FOF exercise. The 

staff is enhancing its understanding of the uses and capabilities of simulation software tools. In 

September 2015, the staff worked with the Institute of Nuclear Materials Management (INMM) to 

conduct a 3-day Vulnerability Assessment Tools Workshop and is in the process of working with 
The Commissioners -3- 

INMM on a second, more detailed workshop. The staff’s efforts to improve the realism and 

effectiveness of FOF exercises will also help to reduce the number of complex simulations in 

NRC-conducted FOF exercises. 

This activity is ongoing. 

Physical Protection Significance Determination Process 

The staff performs an annual audit of SDPs and associated tools as part of the NRC’s routine 

Reactor Oversight Process Self-Assessment Program. As part of this process, the staff initiated 

a review of all of the SDPs that support the Security Baseline Inspection Program. In 

December 2015, the Offices of Nuclear Security and Incident Response and Nuclear Reactor 

Regulation assembled a team, with representatives from headquarters and each regional office, 

to conduct an effectiveness review of the Security Baseline Inspection Program and to audit the 

security SDPs and associated tools. The team reviewed recent SDP revisions, including a 

revised SDP associated with the FOF program, issued in January 2014, and a revised SDP 

associated with UAOs, issued in October 2015. The team also considered possible revisions to 

other areas of the security assessment program, such as, physical protection, target sets, and 

the safeguards information decision tree. The team determined that all of these areas should 

be evaluated for possible SDP revisions. The staff will continue to engage NRC stakeholders 

during the first quarter of CY 2016. If the staff concludes that changes to the SDP are 

necessary, the staff will engage external stakeholders for input in the second quarter of CY 

2016, with the goal of issuing the revised SDPs by the end of the CY. 

This activity will be completed by the end of CY 2016. 

Compensatory Measures 

In SECY-14-0088 the staff recommended issuance of a generic communication clarifying when 

licensees should apply compensatory measures. Staff had previously identified that some 

licensees were applying immediate compensatory measures in certain cases where such 

measures were not required under NRC regulations. Staff has developed a draft RIS on 

compensatory measures. This draft RIS reiterates the NRC’s position on the requirements for 

implementation of compensatory measures. Consistent with regulatory requirements, 

compensatory measures must provide a level of protection that is equivalent to the protection 

that was provided by the equipment, system, or component, before it was degraded or 

inoperable. Furthermore, they must be implemented within specific timeframes to ensure that 

the capability to detect, assess, interdict, and neutralize threats to the facility are maintained at 

all times. Additionally, compensatory measures must be described in the licensees’ security 

plans. 

Licensees are not required to immediately implement compensatory measures in all cases. 

However, they are required to take immediate action to assess any identified deficiency to 

determine the cause of the deficiency and the impact of the deficiency on the site’s protective 

strategy. Based on this assessment, the licensee must determine if a compensatory measure is 

required and, if required, whether the compensatory measure must be immediately 

implemented. 
The Commissioners -4- 

The staff expects that the draft RIS will be issued for public comment in the first quarter of CY 

2016, following the NRC’s Generic Communications Process. The staff will consider comments 

received when finalizing the RIS. 

The staff expects to issue the final RIS and complete this activity by the end of CY 2016. 

Improved Realism and Effectiveness 

In September 2015, the staff submitted COMSECY-15-0025, “Proposed Revision to the 

Notification Process for Force-on-Force Inspections,” dated September 11, 2015, (ADAMS 

Accession Number ML15231A232) to the Commission, requesting approval to revise the 

advanced notification to licensees for FOF inspections from an 8- to 12-week period prior to the 

inspection to a new 9- to 15-month period prior to the inspection. The staff also committed to 

monitoring the FOF inspection program to ensure it accurately assesses licensee security force 

readiness and performance. The Commission approved the staff’s request in 

SRM-COMSECY-15-0025, “Staff Requirements – COMSECY-5-0025 – Proposed Revision to 

the Notification Process for Force-on-Force Inspections” (ADAMS Accession Number 

ML115279A468). Consistent with these commitments, the staff made several changes to the 

FOF inspection scenario development process, which were implemented at the beginning of 

January 2016. 

These changes: 

• Reduce the burden associated with licensee inspection preparation and improve 

consistency and realism by replacing the licensee employee “insider” with a standard 

information request for both the NRC inspection team and the CAF; 

• Improve the realism of FOF scenarios by providing a more thorough planning period for 

the inspection team before it arrives on site; 

• Improve the NRC’s ability to ensure an accurate representation of the licensee’s typical 

security response force capabilities is tested during NRC-conducted FOF exercises by 

providing the team lead the ability to select the tested shift; and 

• Improve NRC management oversight of NRC-conducted FOF exercise through 

standardized briefings on the inspection team’s proposed scenarios and TTPs prior to 

the team arriving on site for planning week by conducting an introductory call. 

Now that licensees are notified of their scheduled FOF inspection 9 to 15 months in advance 

through the Reactor Oversight Process notifications they no longer receive a separate FOF 

notification letter. Instead of this notification letter, the NRC FOF inspection team lead will 

conduct an introductory call with the licensee 15 weeks prior to the inspection. During this call, 

the team lead will discuss the inspection procedure, inspection information request, and will 

outline the inspection process for the licensee. Following the introductory call, the team lead will 

send the licensee a standard inspection information request. This information request will list 

the documents and information that the inspection team needs for planning and scenario 

development and will be standard across all licensees. As discussed in detail in Enclosure 1 to 

SECY-14-0088, under the old inspection preparation process, the NRC inspection team would 

select a licensee employee as an “insider” to simulate the information-gathering activities of the 

design basis threat (DBT) adversary. Under the new process, the information provided by the 

licensees will replace the licensee employee “insider” for the FOF inspection. The replacement 

of the “insider” with a standard information packet will provide the inspection team with more 

consistent and realistic information for mission planning. It will also prevent the appearance of 
The Commissioners -5- 

surreptitious testing of the licensee’s insider mitigation program by removing the possibility that 

site personnel may report the insider’s activity to licensee management through the behavioral 

observation program.

With the 15-week introductory call, the NRC inspection team will have additional time at 

headquarters to prepare for the first week of the FOF inspection. The inspection preparation 

process previously began with the transmission of the notification letter 8 to 12 weeks prior to 

the inspection. During this time, the inspection team will use the information provided by the 

licensee to identify possible scenarios, approaches, and tactics for use in the FOF inspection. 

The NRC inspection team will engage the U.S. Special Operations Command advisors during 

this planning process to help ensure that the possible scenarios are realistic, effective, and 

consistent with the DBT. NRC Headquarters Security Risk Analysts will provide assistance to 

the inspection team during the inspection preparations at headquarters but will no longer 

provide in-person support during the FOF planning week. This change will provide for more 

efficient pre-site planning and will reduce the costs to licensees by having fewer people on-site 

during the planning and exercise weeks of FOF inspections. The team lead will choose which 

response shift will be tested during the FOF exercise and communicate this information to the 

licensee. In making this selection, the team lead will ensure that the shift chosen to participate 

in the exercise is an accurate representation of the licensee’s typical response force 

capabilities. Finally, the team lead will develop a briefing for NRC management prior to the 

on-site planning week. This briefing will ensure that NRC management is fully briefed on the 

inspection team’s proposed scenarios and TTPs prior to the team arriving on site for planning 

week. 

During the planning week of the FOF inspection, the CAF director and the NRC inspection team 

will receive joint pre-inspection mission and target briefings. This will allow the CAF director to 

conduct more realistic mission planning under the oversight of the NRC inspection team to 

ensure that the mission plan and proposed tactics are realistic and consistent with the DBT. 

The NRC inspection team will update NRC management on any changes to the proposed 

scenarios and tactics. The remainder of the inspection process will follow normal FOF 

procedures. 

The staff discussed these proposed adjustments to the FOF inspection preparation process with 

representatives from the Nuclear Energy Institute (NEI) at the NEI FOF Working Group meeting 

on November 18, 2015, and a representative from the Union of Concerned Scientists (UCS) at a 

drop-in meeting on November 5, 2015. Feedback from NEI was generally positive, while the 

UCS representative raised some concerns. UCS was concerned that the increase in the 

notification period may provide potential adversaries with additional advantages by knowing the 

FOF inspection dates in advance. The staff examined the UCS concern and considers that the 

likelihood of potential adversary advantage is negligible because the schedules for security 

inspections, including FOF, are not released to the public. 

Licensees were notified of this change in process by letter dated December 21, 2015 (ADAMS 

Accession Number ML15328A197). In this letter, licensees were encouraged to provide 

feedback on these changes as well as the Working Group’s activities. The staff will use this 

feedback to assess further refinements to the inspection process and to inform the notation vote 

paper that the Commission, in SRM-SECY-14-0088, directed the staff to submit in June 2016. 

 
The Commissioners -6- 

In addition to the planned inspection procedure changes based on the change to the notification 

process, the Working Group continues to evaluate other NRC guidance, training, and inspection 

procedures for potential enhancement or development. The Working Group has conducted 

several public meetings and a Federal partners’ briefing to solicit input on its review. The 

Working Group’s initial recommendations will be provided in a report to the Director of the 

Division of Security Operations, in the Office of Nuclear Security and Incident Response, which 

will inform the June notation vote paper. The June 2016 notation vote paper will also include a 

discussion and analysis of feedback on the FOF program received from external stakeholders, 

including several white papers submitted by NEI as well as comments received by the UCS at 

the Working Group’s public meetings. 

This activity is ongoing. The staff will provide an update to the Commission in the June 2016 

notation vote paper. 

Multiple Integrated Laser Engagement System 

The NRC uses MILES equipment to simulate combat between two or more forces (responder 

players and adversaries) and to record those engagements in an electronic format. The NRC 

purchased the current MILES equipment for use in NRC-conducted FOF exercises in 2009. 

The original programming of the equipment provided a realistic simulation of the realities of 

combat that included various combat injuries but was more complex for exercise controllers. In 

2010, the NRC modified the configuration of the MILES equipment to provide a more basic 

simulation combat by providing only “kill,” “miss,” and “near miss” readings. This configuration 

simplified the control of players wearing MILES equipment but introduced a number of software 

errors that led to unplanned timeouts during NRC-conducted FOF exercises. In SECY-14-0088, 

the staff recommended restoring the MILES equipment to its original configuration in order to 

improve FOF exercise realism and reduce the number of exercise timeouts. In SRM-SECY-14-

0088, the Commission directed the staff to fully evaluate the pros and cons of this change to 

determine whether the MILES equipment configuration change would result in an overall 

enhancement to FOF exercises. 

In May 2015, the manufacturer provided an update to the software for the MILES equipment 

used during NRC-conducted FOF exercises. This software update has significantly reduced the 

incidents of software errors during NRC-conducted FOF exercises. While there have still been 

some anomalies in MILES performance, these anomalies have been rare and have not 

impacted NRC-conducted FOF exercises. All equipment anomalies are reviewed by contract 

engineers and the equipment is removed from service until an evaluation is completed. The 

NRC has conducted outreach with nuclear power plant licensees and found that there are no 

nuclear power plant licensee using the MILES equipment in its original configuration for their 

annual FOF drills and exercises. Licensees are not familiar with the more complex MILES 

configuration (the inclusion of “critical” and “light” wound readings); therefore, the staff has 

determined that restoring the equipment to its original configuration would be more costly and 

time-consuming to implement than the staff previously anticipated. 

Based on these considerations, the staff no longer recommends restoring the MILES equipment 

software to its original configuration. The May 2015 software update has significantly reduced 

the errors caused by the modified MILES software configuration. Further, the staff has 

determined that the improvements to exercise realism are not sufficient to justify the costs and 
The Commissioners -7- 

additional training associated with restoring the MILES equipment used during NRC-conducted 

FOF exercises to its original configuration. 

This activity is complete. 

Unattended Openings 

In SRM-SECY-14-0088, the Commission directed the staff to take into account the realistic 

ability for an adversary to exploit specific opening configurations when evaluating inspection 

findings and assessing licensee corrective actions. In the longer term, the Commission directed 

the staff to evaluate the NRC requirements for UAOs through the same NRC working group 

established to evaluate tactics and to evaluate any changes through a formal change control 

process with stakeholder input. 

The Working Group reviewed the NRC’s requirements for UAOs taking into consideration 

information that the staff had developed on the training and capabilities of real-world terrorists. 

The Working Group did not find a technical basis that would support changing the NRC’s 

requirements for UAOs. The Working Group reaffirmed the staff’s conclusion in SECY-14-0088 

that the NRC’s requirements for UAOs are consistent with the standards used by other Federal 

agencies and private industry. Additionally, the Working Group found that the NRC’s 

requirements and guidance for UAOs are realistic because they only require protection of those 

UAOs that could reasonably be exploited by the DBT adversary. Rather than change the NRC’s 

requirements for UAOs, the Working Group initiated an update to the SDP for UAOs. The 

revised UAO SDP was issued in October 2015. 

The Working Group found that the subjectivity of the previous SDP for UAOs made it difficult for 

NRC inspectors to account for the possibility that specific opening configurations might be 

exploited by a DBT adversary. For example, the SDP evaluated the significance of UAO 

findings by determining the “probability of adversary effectiveness,” but provided no objective 

means for an inspector to make this assessment. The inspector would characterize the 

exploitability of a specific UAO configuration as “very low,” “low,” “medium,” or “high” and would 

use this characterization, along with the length of time that the vulnerability had existed, to 

determine the significance of the finding. Based on feedback from the Working Group, the staff 

determined that it should address this subjectivity through a revision to the SDP for UAOs that 

would provide inspectors with objective criteria for assessing UAO findings. 

The staff conducted an analysis and developed an SDP that could appropriately characterize 

UAO findings in a predictable and repeatable fashion while reducing inspector subjectivity. The 

staff developed an SDP that allows for a more objective assessment of UAO findings by taking 

into account how physical barriers and intrusion detection systems might impact the ability of 

the DBT adversary to exploit a UAO. Under the revised SDP, the significance of a UAO finding 

is determined based on the number of physical barriers or intrusion detection systems that an 

adversary would encounter when using the UAO as a pathway to the desired target set 

equipment. These barriers and/or detection systems provide the licensee with opportunities to 

detect and interdict the adversary between the UAO and the target set equipment, thereby 

potentially reducing the significance of the finding. 

 
The Commissioners -8- 

A publicly-released version of the SDP was presented at a public meeting on May 26, 2015, 

without the Official Use Only – Security-Related Information (OUO-SRI) details, and received no 

comments. The meeting was attended by representatives from the nuclear industry, NEI, and 

UCS. The full version of the proposed SDP revision was also sent to industry for 

comment. The NEI responded back to the NRC with minimal comments, which were 

considered and addressed. 

The staff issued the revised UAO SDP in October 2015. The revised SDP is considered 

OUO-SRI. 

This activity is complete. 

CONCLUSION: 

The staff continues to make progress on the commitments identified in SECY-14-0088. The 

staff has addressed two of the items in the Commission’s direction from SRM-SECY-14-0088 

and will provide a notation vote paper in June 2016 to present the findings of the Working 

Group. The staff will continue to keep the Commission informed on its progress via CA Notes 

and this annual information paper. 

COORDINATION: 

The Office of the General Counsel has reviewed this paper and has no legal objection. 

 /RA/ 

Victor M. McCree, 

Executive Director 

 for Operations 
The Commissioners - 8 - 

1 

2 A publicly-released version of the SDP was presented at a public meeting on May 26, 2015, 

3 without the Official Use Only – Security-Related Information (OUO-SRI) details, and received no 

4 comments. The meeting was attended by representatives from the nuclear industry, NEI, and 

5 UCS. The full version of the proposed SDP revision was also sent to industry for 

6 comment. The NEI responded back to the NRC with minimal comments, which were 

7 considered and addressed. 

8 

9 The staff issued the revised UAO SDP in October 2015. The revised SDP is considered 

10 OUO-SRI. 

11 

12 This activity is complete. 

13 

14 CONCLUSION: 

15 The staff continues to make progress on the commitments identified in SECY-14-0088. The 

16 staff has addressed two of the items in the Commission’s direction from SRM-SECY-14-0088 

17 and will provide a notation vote paper in June 2016 to present the findings of the Working 

18 Group. The staff will continue to keep the Commission informed on its progress via CA Notes 

19 and this annual information paper. 

20 

21 COORDINATION: 

22 The Office of the General Counsel has reviewed this paper and has no legal objection. 

23 

24 

25 

26 /RA/ 

27 

28 Victor M. McCree, 

29 Executive Director 

30 for Operations 

31 

32 

33 

34 

35 

36 ADAMS Accession No. ML16021A313 

37 SRM-S14-0088-001, SRM-S14-0088-003, and SRM-S14-0088-004 

OFFICE NSIR/DSO NSIR/DSP NSIR/DSO OGC NSIR/OD EDO 

NAME M. Ralph * 

via email 

M. Thaggard M. Layton N. StAmour B. Holian V. McCree 

DATE 01/21/2016 02/01/16 02/01/16 02/18/16 02/19/16 02/25/16 

38 OFFICIAL RECORD COPY 

39