**NRC INSPECTION MANUAL**	UNPO

INSPECTION PROCEDURE 81621

FIXED SITE PHYSICAL PROTECTION OF CATEGORY 1 AND CATEGORY 2 QUANTITIES 

OF RADIOACTIVE MATERIAL – NON-POWER REACTORS

Effective Date:  06/01/2020

PROGRAM APPLICABILITY:  IMC 2545

This inspection procedure (IP) is applicable to all U.S. Nuclear Regulatory Commission (NRC) licensed non-power reactors that, as a condition of the Part 50 reactor license, possess aggregated category 1 or category 2 quantities of radioactive material.

81621-01	INSPECTION OBJECTIVE

The objective of this IP is to gather information to determine whether reasonable assurance exists that licensee activities, since the last inspection, were conducted in accordance with regulatory requirements in Title 10 of the *Code of Federal Regulations* (CFR) Part 37, “Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material.”

01.01	Access Authorization.  To assure that the licensee has an access authorization program that will provide a basis upon which to make a determination of trustworthiness and reliability of personnel granted unescorted access to category 1 or category 2 quantities of radioactive material.

01.02	Physical Protection During Use.  To assure that the licensee can monitor, detect, assess, and respond  to an actual or attempted unauthorized access to category 1 or category 2 quantities of radioactive material.

81621-02	INSPECTION REQUIREMENTS

02.01	Access Authorization.

a. Reviewing Officials.

1. Verify that the licensee named, certified, and recertified any reviewing official(s) who provides determinations that individuals are trustworthy and reliable based on the results of an FBI fingerprint-based criminal history records check. [10 CFR 37.23(b)(2)]

2. Verify that the reviewing officials are permitted to have unescorted access to category 1 or category 2 quantities of radioactive materials or access to safeguards information. [10 CFR 37.23(b)(3)]

3. Verify that the reviewing officials have not approved other individuals to act as reviewing officials. [10 CFR 37.23(b)(4)]

b. Informed Consent.

1. Verify that the licensee has not initiated background investigations or reinvestigations without the informed and signed consent of any individual. [10 CFR 37.23(c)(1)]

2. Verify that the licensee has a process for an individual to withdraw consent at any time. [10 CFR 37.23(c)(2)]

c. Personal History Disclosure.  Verify that individuals disclose personal history information required by the licensee access authorization program for the reviewing official to make the trustworthiness and reliability determination. [10 CFR 37.23(d)]

d. Determination Basis.

1. Verify that the reviewing official is appropriately determining whether to permit, deny, unfavorably terminate, maintain, or administratively withdraw an individual’s unescorted access based on an evaluation of all the information collected. [10 CFR 37.23(e)(1)]

2. Verify that the reviewing official has determined an individual is trustworthy and reliable prior to granting unescorted access. [10 CFR 37.23(e)(2)]

3. Verify that the licensee has documented the basis for determining whether or not there is reasonable assurance that an individual is trustworthy and reliable. [10 CFR 37.23(e)(3)]

4. Verify that the reviewing official can terminate or administratively withdraw an individual’s unescorted access based on information obtained at any time. [10 CFR 37.23(e)(4)]

5. Verify that the licensee has maintained a list of persons currently approved for unescorted access. [10 CFR 37.23(e)(5)]

6. Verify that the licensee can take prompt measures to ensure that individuals no longer requiring access or meeting the access authorization requirements are unable to have unescorted access to the material. [10 CFR 37.23(e)(5)]

e. Procedures.  Verify that the licensee has developed, implemented, and maintained written procedures for implementing the access authorization program. [10 CFR 37.23(f)]

f. Right to Correct and Complete Information.  Verify that the licensee has a process for allowing individuals the right to complete and correct information. [10 CFR 37.23(g)]

g. Records.

1. Verify that the licensee retains documentation regarding the trustworthiness and reliability determinations of individual employees for 3 years after the date the individual no longer requires unescorted access. [10 CFR 37.23(h)(1)]

2. Verify that the licensee retains a copy of the current access authorization procedures as a record for 3 years after the date the procedure is no longer needed.  If any portion of the procedure is superseded, the licensee shall maintain a copy of the superseded material for 3 years after the record is superseded. [10 CFR 37.23(h)(2)] 

3. Verify that the licensee retains a copy of the list of persons approved for unescorted access for 3 years after the list is superseded or replaced. [10 CFR 37.23(h)(3)]

h. Background Investigations.

1. Verify that the initial investigation of individuals for unescorted access to category 1 and category 2 quantities of radioactive material consists of, at a minimum, the following: 1) fingerprinting and FBI identification and criminal history records check; 2) verification of true identity; 3) employment history verification; 4) education verification; 5) character and reputation determination; 6) independent corroboration; and, 7) alternate information sources. [10 CFR 37.25(a)]

2. If applicable, verify that licensee appropriately grandfathered individuals who were previously determined to be trustworthy and reliable under fingerprinting orders or access authorization programs under 10 CFR 73.57. [10 CFR 37.25(b)]

3. Verify that the licensee conducts reinvestigations every 10 years for individuals with unescorted access to category 1 or category 2 quantities of radioactive material. [10 CFR 37.25(c)]

i. Criminal History Records Check.  Verify that the licensee obtains fingerprints for a criminal history records check for each individual who is to be permitted unescorted access to category 1 or category 2 quantities of radioactive material. [10 CFR 37.27]

j. Relief from Fingerprinting and Background Investigations.  As applicable, verify that the licensee appropriately determines personnel meet the exemption criteria of the category of individuals to be exempt from the criminal history records check and background check.  [10 CFR 37.29]

k. Protection of Information.  Verify that the licensee appropriately protects records and personal information from unauthorized disclosure. [10 CFR 37.31]

l. Access Authorization Program Review.  Verify that the licensee (at least annually) reviewed the program content and implementation, initiated corrective actions to address conditions adverse to proper program performance, reassessed deficient areas, and maintained review records for 3 years. [10 CFR 37.33]

02.02	Physical Protection During Use.

a. Security Program and Plan.

1. For applicants for a new license and each licensee that would become newly subject to Part 37, verify implementation of a security program prior to the licensee taking possession of an aggregated quantity of category 1 or category 2 radioactive material. [10 CFR 37.41(a)(2)]

2. For any licensee that has not previously implemented security orders or been subject to Part 37, verify that the licensee has provided written notification to the NRC regional office prior to aggregating radioactive material to a quantity that exceeds the category 2 threshold. [10 CFR 37.41(a)(3)]

3. Verify that the licensee has developed, reviewed, approved, and maintained a written security plan.  [10 CFR 37.43(a)(1), 10 CFR 37.43(a)(2), 10 CFR 37.43(a)(3)(i)]

4. Verify that the licensee has trained affected individuals on any security plan revisions before the changes are implemented.  [10 CFR 37.43(a)(3)(ii)]

5. Verify that the licensee maintains security plans as a record for three years after the date the plan is no longer needed.  If any portion of the plan is superseded, the licensee shall maintain a copy of the superseded material for three years after the record is superseded. [10 CFR 37.43(a)(4)]

b. Implementing Procedures.

1. Verify that the licensee has developed, reviewed, approved, and maintained written implementing procedures. [10 CFR 37.43(b)(1), 10 CFR 37.43(b)(2)]

2. Verify that the licensee maintains procedures as a record for three years after the date the procedure is no longer needed.  If any portion of a procedure is superseded, the licensee shall maintain a copy of the superseded material for three years after the record is superseded. [10 CFR 37.43(b)(3)]

c. Training.

1. Verify that the licensee conducts training for individuals implementing the program, commensurate with assigned duties and responsibilities, to include: security program and procedures; NRC reporting requirements; local law enforcement agency (LLEA) reporting requirements; and, alarm response procedures. [10 CFR 37.43(c)(1), 10 CFR 37.43(c)(2)]

2. Verify that the licensee conducts refresher training on a frequency not to exceed 12 months or following significant program changes, to include: review of initial training requirements and any changes; reports on security issues, problems, and lessons learned; NRC inspection results; and, licensee program review and maintenance and testing results. [10 CFR 37.43(c)(3)]

3. Verify that the licensee maintains training records for three years from the date of training, to include: training dates; topics covered; attendance list; and related information. [10 CFR 37.43(c)(4)]

d. Protection of Information.

1. Verify that the licensee limits access to and unauthorized disclosure of the security plan, implementing procedures, and list of individuals approved for unescorted access. [10 CFR 37.43(d)(1)]

2. Verify that the licensee has developed, implemented, and maintained written policies and procedures for controlling access to, and for proper handling and protection against unauthorized disclosure of, the security plan, implementing procedures, and the list of individuals approved for unescorted access. [10 CFR 37.43(d)(2)]

3. Verify that the licensee ensures an individual has a need to know and the trustworthiness and reliability determination completed before being granted access to the security plan, implementing procedures, and the list of individuals approved for unescorted access. [10 CFR 37.43(d)(3)]

4. Verify that the licensee received written verifications from the security service provider that security service provider employees are trustworthy and reliable. [10 CFR 37.43(d)(4)(ii)]

5. Verify that the licensee has documented the basis for concluding that an individual is trustworthy and reliable and should be granted access to the security plan, implementing procedures, and the list of individuals approved for unescorted access. [10 CFR 37.43(d)(5)]

6. Verify that the licensee has maintained a list of persons currently approved for access to the security plan, implementing procedures, and the list of individuals approved for unescorted access. [10 CFR 37.43(d)(6)]

7. Verify that the licensee can take prompt measures to ensure individuals who no longer require access or meet the access requirements, are unable to have access to the security plan, implementing procedures, and the list of individuals approved for unescorted access. [10 CFR 37.43(d)(6)]

8. Verify that the licensee stored the security plan, implementing procedures, and the list of individuals approved for unescorted access in a manner to prevent unauthorized access. [10 CFR 37.43(d)(7)]

9. Verify that the licensee maintained the following records for three years after no longer needed: (1) a copy of the information protection procedures, (2) the list of individuals approved for access to the security plan and implementing procedures, and (3) the list of individuals approved for unescorted access. [10 CFR 37.43(d)(8)]

e. LLEA coordination.

1. Verify that the licensee coordinated, to the extent practicable, with an LLEA for responding to threats to the licensee’s facility, including any necessary armed response, to include: (1) a description of the facility, (2) category 1 or category 2 quantities of radioactive materials, (3) security measures, and (4) a notification that the licensee will request a timely armed response to any actual or attempted theft, sabotage, or diversion of category 1 or category 2 quantities of radioactive materials. [10 CFR 37.45(a)]

2. Verify that the licensee documented efforts to coordinate with the LLEA and maintained documentation for three years. [10 CFR 37.45(c)]

3. Verify that the licensee coordinated with the LLEA at least every 12 months. [10 CFR 37.45(d)]

f. Security Zones.

1. Verify that the licensee ensures category 1 and category 2 quantities of radioactive materials are stored or used within permanent or temporary, licensee-established security zones. [10 CFR 37.47(a), 10 CFR 37.47(b)]

2. Verify that established security zones only allow unescorted access to approved individuals through the use of: (1) continuous physical barriers and control points, (2) direct control of the security zone by approved individuals, or (3) a combination of continuous physical barriers and direct control. [10 CFR 37.47(c)]

3. For category 1 quantities of radioactive materials, verify that the licensee provided sufficient approved individuals to maintain continuous surveillance in temporary security zones and in any permanent security zone in which physical barriers or intrusion detection systems have been disabled during periods of:  (1) maintenance, (2) source receipt, (3) shipment preparation, (4) installation, (5) source removal, or (6) source exchange. [10 CFR 37.47(d)]

4. Verify that individuals not approved for unescorted access are escorted by an approved individual when in a security zone. [10 CFR 37.47(e)]

g. Monitoring, Detection, Assessment, and Response.

1. Verify that the licensee has established and maintained the capability to monitor and detect, without delay, all unauthorized entries into security zones or provide for alarm and response in the event of loss of monitoring and detection capabilities, including during a loss of power.  [10 CFR 37.49(a)(1)]

2. Verify that the monitoring and detection is performed by:  (1) a monitored intrusion detection system linked to an on-site or off-site central monitoring facility, (2) electronic devices for intrusion detection alarms that will alert nearby facility personnel, (3) monitored video surveillance system, (4) direct visual surveillance by approved individuals within security zones, or (5) direct visual surveillance by a licensee designated individual located outside the security zone. [10 CFR 37.49(a)(2)]

3. For category 1 quantities of radioactive material, verify that the licensee has the capability to *immediately* detect any attempted unauthorized removal of the radioactive material from the security zone through: electronic sensors linked to an alarm; continuously monitored video surveillance; or, direct visual surveillance. [10 CFR 37.49(a)(3)(i)]

4. For category 2 quantities of radioactive material, verify that the licensee conducts weekly verification through physical checks, tamper indicating devices, or other means, to ensure that the radioactive material is present. [10 CFR 37.49(a)(3)(ii)]

5. Verify that the licensee immediately assesses each actual or attempted unauthorized entry into the security zone to determine whether the unauthorized access was an actual or attempted theft, sabotage, or diversion. [10 CFR 37.49(b)]

6. Verify that primary and alternate capabilities exist to ensure continuous personnel communications and data transmissions supporting the monitoring, detection, and assessment systems, where both capabilities have different failure modes. [10 CFR 37.49(c)]

7. Verify that the licensee immediately responds to any actual or attempted unauthorized access to permanent or temporary security zones, or actual or attempted theft, sabotage, or diversion of category 1 or category 2 quantities of radioactive material. [10 CFR 37.49(d)]

8. For any unauthorized access involving an actual or attempted theft, sabotage, or diversion of category 1 or category 2 quantities of radioactive material, verify that the licensee response includes requesting, *without delay*, an armed response from the LLEA. [10 CFR 37.49(d)]

h. Maintenance and Testing.

1. Verify that the licensee implemented a maintenance and testing program to ensure all systems used to secure or detect unauthorized access to radioactive materials are maintained in an operable condition and capable of performing their intended function. The licensee shall inspect and test equipment for operability and performance at the manufacturer’s suggested frequency.  If there is no manufacturer’s suggested frequency, the testing must be performed at least annually, not to exceed 12 months. [10 CFR 37.51(a)]

2. Verify that the licensee maintained records on the maintenance and testing activities for three years. [10 CFR 37.51(b)]

i. Mobile Devices.

1. Verify that the licensee has two independent physical controls that form tangible barriers to secure the material from unauthorized removal when the device is not under constant surveillance or direct control.  [10 CFR 37.53(a)]

2. For devices in or on a vehicle or trailer, verify that the licensee utilizes a method to disable the vehicle or trailer when not under constant surveillance or direct control. [10 CFR 37.53(b)]

j. Security Program Review.

1. Verify that the licensee conducted reviews, documented review results, implemented corrective actions, and reassessed deficient areas of the security program to ensure compliance and continuing effectiveness at least annually. [10 CFR 37.55(a), 10 CFR 37.55(b)]

2. Verify that the licensee maintained review documentation for three years. [10 CFR 37.55(c)]

k. Reporting of Events.

1. Verify that the licensee immediately notified LLEA after determining that an unauthorized entry resulted in an actual or attempted theft, sabotage, or diversion of a category 1 or category 2 quantity of radioactive material. As soon as possible, after initiating a response, but not more than 4 hours after discovery, verify that the licensee notified the NRC Operations Center.  Verify that the licensee provided an appropriately detailed 30-day report following any such notification. [10 CFR 37.57(a), 10 CFR 37.57(c)]

2. Verify that the licensee assessed and notified the LLEA of any suspicious activity related to possible theft, sabotage, or diversion of category 1 or category 2 quantities of radioactive material.  As soon as possible, but not more than 4 hours after notifying the LLEA, verify that the licensee notified the NRC Operations Center. [10 CFR 37.57(b)]

81621-03	INSPECTION GUIDANCE

This section is intended to provide guidance to assist the inspector in measuring the licensee’s performance in each of the preceding sections.  The statements below do not represent regulatory requirements, but are standards and methods by which the individual elements may be judged.  The inspector should be aware that any written inspection notes, related to the specific details of how a licensee is in compliance with the regulatory requirements, could be security related and should be protected from unauthorized disclosure. Care should be exercised to avoid recording site-specific details and instead use general statements related to compliance with the regulations.

The regulatory requirements in 10 CFR Part 37 are prescriptive and, in almost all instances, require written documentation and records as evidence of compliance.  Therefore, inspection activities should consist mostly of records review.  The inspector should consider opportunities for observation of licensed activities relating to category 1 and category 2 quantities of material, when available. 

Non-power reactor facilities typically generate, receive, possess, use, or transfer category 1 or category 2 quantities of radioactive materials in the form of sources, irradiators, or bulk quantities for commercial purposes (e.g., sealed sources, radiopharmaceuticals).  Non-power reactor facilities do not typically have large components, robust structures, or system components containing activation products that would meet or exceed a category 2 threshold.  However unlikely for non-power reactors, should such conditions exist, inspectors, in consultation with the Branch Chief, should refer to enforcement discretion in EGM-14-001 (ADAMS Accession No. ML14056A151). 

NUREG-2155, “Implementation Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material,” contains implementing guidance that may provide inspectors with additional information and insight on methods that the licensee could choose to use in order to meet the regulatory requirements.  Manual Chapter 2800 also contains guidance regarding these types of material inspections.  Considering the potential overlap in how the licensee implements the regulatory requirements in both 10 CFR Part 37 and 10 CFR Part 73, these security inspections should be conducted at the same interval and completed during the same visit, to the extent practicable. 

03.01	Access Authorization.

The inspector should note that individuals deemed to be trustworthy and reliable under provisions of an NRC-approved Part 73 physical security plan or post-9/11 compensatory measures may be acceptable, provided the program meets all of the access authorization requirements of Part 37.  Not all non-power reactors are required to or committed to implement background investigations consisting of the same elements required by 10 CFR 37.25(a).  The inspector should verify the other requirements that may be unique to Part 37 are being met.

03.02	Physical Protection During Use.

The inspector should note the specificity in the requirements for documentation of LLEA coordination activities.  While the licensee is likely in compliance with requirements by having university police support or memoranda of understanding in place with other LLEA, the regulations require documentation of coordination, to include the appropriate information, at least every 12 months.  

The inspector should note that the licensee is required to be able to monitor and detect, *without delay*, unauthorized entries into security zones.  Depending on placement of the radioactive materials, this requirement could be met by the physical protection systems installed at nonpower reactor facilities.  

For category 1 quantities of radioactive material, the inspector should note that the licensee is required to *immediately*detect any attempted unauthorized removal.  There are a number of ways that this requirement could be met, from the use of alarms and positive physical controls to alarms and electronic detection equipment.  

The inspector should note that the licensee is required to request, *without delay*, an armed LLEA response following an unauthorized entry that resulted in an attempted or actual theft, sabotage, or diversion.  The inspector could consider reviewing the licensee’s written response and contingency procedures to determine potential compliance with this requirement.

81621-04	RESOURCE ESTIMATE

For planning purposes, the estimated, direct, onsite inspection effort to complete this inspection procedure is 24 hours.  Actual inspection at any facility may require more or less effort depending on past inspection history, changes since the last inspection, conditions at the facility, and significance of the inspection findings.

81621-05	PROCEDURE COMPLETION

The inspection of each of the applicable areas described above will constitute completion of this procedure.  This inspection procedure will be completed on a five (5) year frequency, with an allowable grace period of one (1) year.  It is recommended that inspectors consider performing this procedure during every other security and safeguards inspection for non-power reactors, or every four (4) to six (6) years.

81621-06	REFERENCES

NUREG-2155, “Implementation Guidance for 10 CFR Part 37, ‘Physical Protection of Category 1 and Category 2 Quantities of Radioactive Material”

NUREG-2166, “Physical Security Best Practices for the Protection of Risk-Significant Radioactive Material”

Manual Chapter 2545, “Research and Test Reactor Inspection Program”

Manual Chapter 2800, “Materials Inspection Program”

END

Attachment:

****

	1.	Revision History Sheet for IP 81621

Issue Date: 10/01/2009	1	35007

Issue Date:  03/13/20	16	81621

Attachment 1 - Revision History for IP 81621

Issue Date:  03/13/20	Att1-17	81621