**NRC INSPECTION MANUAL**NSIR/DSO

INSPECTION MANUAL CHAPTER 0609, APPENDIX E

SECURITY SIGNIFICANCE DETERMINATION PROCESS FOR POWER REACTORS

0609E-01PURPOSE

01.01Baseline Security Significance Determination Process. – The purpose of the Baseline Security Significance Determination Process (BSSDP) is to provide an objective means of evaluating findings related to common defense and security for activities licensed by the U.S. Nuclear Regulatory Commission (NRC) as defined in Inspection Manual Chapter (IMC) 2201, “Security Inspection Program for Operating Commercial Nuclear Power Reactors.”  The process also will be used to provide assurance that licensees’ safeguards systems can effectively protect against the design basis threat (DBT) based on defense-in-depth layers of protection as part of licensees’ commitments to NRC requirements.

01.02Force-on-Force Significance Determination Process. – The purpose of the 

Force-on-Force Significance Determination Process (FOFSDP) is to provide an objective means of evaluating findings associated with marginal exercise performance and exercise failures in the implementation of licensees’ protective strategies.  Other security-related findings identified during force-on-force (FOF) activities that are not directly related to FOF exercise outcomes will be evaluated using the BSSDP.

01.03Construction Fitness-for-Duty Significance Determination Process. – The purpose of the Construction Fitness-for-Duty Significance Determination Process (CFFDSDP) is to provide an objective means by which NRC inspectors and management can assess the significance of fitness-for-duty (FFD) findings identified at facilities subject to Title 10 of the *Code of Federal Regulations* (10 CFR) Part 26, “Fitness for Duty Programs,” for which a Limited Work Authorization or a Combined License has been issued authorizing construction activities.  These inspection activities are associated with IMC 2200, “Security Inspection Program for Construction,” which, in part, provides assurance that construction activities are not adversely affected because of FFD issues.

01.04Cyber Security Significance Determination Process for Power Reactors. – The purpose of the Cyber Security Significance Determination Process for Power Reactors (CSSDP) is to provide an objective means of evaluating findings relating to cyber security requirements for power reactors licensed by the NRC.

0609E-02OBJECTIVES

02.01The objective of the Physical Protection Cornerstone is to provide assurance that the safeguards systems and programs effectively protect against the DBT and the loss or theft of special nuclear materials.  The attributes of this cornerstone are based on defense-in-depth strategies and are intended to provide protection against both internal and external threats.  The NRC assesses licensee performance in this cornerstone by determining the significance of security-related issues and findings.

02.02The BSSDP is the tool with which NRC inspectors will assess the risk or security significance of findings.  This process consists of a deterministic, logic-flow chart that will allow individual findings to be categorized into one of the four response bands:  GREEN—a finding of very low safety and security significance; WHITE—a finding of low to moderate safety and security significance; YELLOW—a finding of substantial safety and security significance; or RED—a finding of high safety and security significance.

02.03Under the security cornerstone, the Significance Determination Processes (SDPs) for operating power reactors addresses physical protection in two parts; Part I for the baseline inspection activities routinely conducted by the regional inspection staff, and Part II for FOF exercises routinely conducted by the Headquarters inspection staff.

02.04The CFFDSDP for new reactors is identified in IMC 0609, Appendix E, Part III, and “Construction Fitness for Duty Significance Determination Process for New Reactors.”  Regional inspection staff members routinely conduct these inspections.

02.05The CSSDP is identified in IMC 0609, Appendix E, Part IV, and “Cyber Security Significance Determination Process for Power Reactors.”  The CSSDP addresses significance determination for cyber security inspection activities routinely conducted by Headquarters and Regional inspection staff. 

0609E-03APPLICABILITY

The SDPs described in this manual chapter are applicable to inspection findings identified through the implementation of the NRC’s inspection programs described in IMC 2201 and IMC 2200.

0609E-04DEFINITIONS

Applicable definitions can be found in the “Definitions” section of IMC 0611, “Power Reactor Inspection Reports,” and IMC 0613, “Power Reactor Construction Inspection Reports.”

0609E-05RESPONSIBILITIES AND AUTHORITIES

All NRC inspectors are required to assess the significance of inspection findings in accordance with the guidance provided in this manual chapter.  General and specific responsibilities are listed below.

05.01Director, Office of Nuclear Reactor Regulation. 

a. Provides overall program direction for the reactor oversight process (ROP) and Construction Reactor Oversight Process (cROP).

b. Develops and directs the implementation of policies, programs, and procedures for regional application of the SDP in the evaluation of findings and issues associated with the ROP and cROP.

c. Assesses the effectiveness, uniformity, and completeness of regional    implementation of the SDP.   

05.02Director, Office of Nuclear Security and Incident Response.

a. Provides overall program direction for the security cornerstones within the ROP and cROP.

b. Develops and directs the implementation of policies, programs, and procedures for regional application of the security SDPs in the evaluation of findings and issues associated with the security cornerstone relative to the ROP or cROP.

05.03Director, Division of Security Operations.

a.Approves all SDPs for the security cornerstone within the ROP and cROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b. Provides oversight and representatives, as necessary, to support the Significance and Enforcement Review Panel (SERP) to ensure consistent and timely application of the process.

05.04  Director, Division of Physical and Cyber Security Policy 

a.Approves all cyber security SDPs associated with the ROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b.Provides oversight and representatives, as necessary, to support the SERP to ensure consistent and timely application of the process.

05.05Director, Division of Reactor Oversight 

a. Approves all SDPs related to the ROP and directs the development of future SDPs and improvements through periodic revisions based on new risk insights and feedback from users.

b. Provides oversight and representatives, as necessary, to support the SERP to ensure consistent and timely application of the process.

05.06Regional Administrators.

a.Provides program direction for management and implementation of SDPs to activities performed by the regional office.

b.Maintains overall responsibility for and application of regional resources, as necessary, to determine the significance of specific inspection findings in a timely manner using best available information consistent with the SDP-timeliness goal and associated SDP-timeliness metrics.

05.07Director, Construction Project Office (e.g., Vogtle Project Office (VPO)).

a.Approves all SDPs related to the cROP and directs the development of future SDPs and improvements through periodic revisions based on new insights and feedback from users.

b.Provides oversight and representatives as necessary to support the Significance and Enforcement Review Panel (SERP) in order to ensure consistent and timely application of the process.

05.08 Director, Division of Risk Assessment (DRA).

a.Provides support to the development of plant specific construction SDPs, specifically with regard to the assignment of systems and components to the risk importance axis of the construction SDP matrix.

b.Provides oversight and representatives as necessary to support the SERP in order to ensure consistent and timely application of the process.

05.09 Director, Division of Construction Oversight (DCO), Region II. 

a.Provides program direction for management and implementation of the SDP to inspection activities performed by DCO staff. 

b.Maintains overall responsibility for, and applies regional resources as necessary, to determine the significance of specific inspection findings in a timely manner, using best available information consistent with the SDP timeliness goal and associated SDP timeliness metrics.

05.10Director, Office of Enforcement.

a.Ensures consistent application of the enforcement process to violations of NRC regulations with the appropriate focus on the significance of the finding.

b.Provides representatives, as necessary, to support the SERP to ensure consistent application of the enforcement process.  

c.Coordinates with the Office of Nuclear Reactor Regulation (NRR) and the Office of Nuclear Security and Incident Response (NSIR), when necessary when revising agency documents used for communicating to the licensee about apparent violations and final determinations associated with the ROP or the cROP.

0609E-06BACKGROUND

Background information on the security SDP can be found in IMC 0308, Attachment 6, “Basis Document for Security Cornerstone of the Reactor Oversight Process.”

0609E-07SDP DEVELOPMENT AND FEEDBACK PROCESS

07.01SDP Development.  The development of a new SDP or significant modification of an existing SDP should follow the general process used for original SDP development.  This process should include the following general steps:

a. The draft of the SDP or the modification is subjected to internal NRC stakeholder review, including NRC regional input.  Early external stakeholder input also may be solicited through public meetings, if appropriate.

b. NRC staff performs a feasibility review to assess the adequacy of the proposed SDP or changes.  This review should specifically involve regional representation and should test the SDP with real (preferred) or hypothetical inspection finding examples.  This review should determine if the proposed SDP or change is ready to be issued for appropriate stakeholder comment or for initial evaluation through field use by regional inspectors.

c. Upon reconciliation of stakeholder comments and initial user feedback, the NRC issues the SDP or change as a revision to this manual chapter.

d. The NRC provides appropriate training to its inspection staff.

07.02SDP Feedback and Improvement.  IMC 0801, “Reactor Oversight Process Feedback Program,” describes in detail the feedback process and feedback form used by NRR, Division of Inspection and Regional Support, to document problems, concerns, or difficulties encountered during implementation of the NRC’s ROP.

To help ensure the consistent application of the security SDP and security SDP results, the staff 

shall perform an annual self-assessment of the security SDP and associated tools.  This assessment shall be performed in accordance with IMC 0307, Appendix A, “Reactor Oversight Process Self‐Assessment Metrics and Data Trending.”

0609E-08SDP AND ENFORCEMENT REVIEW PANEL PROCEDURES

Refer to the applicable sections in IMC 0609 or IMC 2519 “Construction Significance Determination Process” for information on the SDP and enforcement review panel procedures.

0609E-09PROCESS FOR LICENSEE APPEAL OF A STAFF SDP DETERMINATION

If a licensee disagrees with the staff’s final determination of significance, the licensee may appeal the determination to the appropriate NRC regional administrator or appropriate office director; for FOF, NSIR is the issuing organization.  Any such review must meet the requirements stated in the Prerequisites and Limitations sections described in Attachment 2 of IMC 0609 or IMC 2519.  Specifically, the licensee must have opted for an opportunity to present additional information to the staff either by meeting with regional or headquarters management, as appropriate, at a regulatory conference or by submitting a written response on the docket.

0609E-10USING THE SDP TO DETERMINE THE SIGNIFICANCE OF INSPECTION FINDINGS THAT ARE NOT VIOLATIONS OF THE LICENSING OR DESIGN BASIS

The staff’s use of the SDP to determine the significance of the result or consequence of a licensee performance deficiency will be made regardless of if the result or consequence constitutes a violation of a licensee’s licensing or design basis or any other regulatory requirement or commitment.  Agency follow-up of such findings, if determined to be significant, will be handled in accordance with the backfit rules of 10 CFR 50.109, “Backfitting,” as appropriate.

0609E-11REFERENCES

MD 8.13, Reactor Oversight Process

IMC 2200, “Security Inspection Program for Construction”

IMC 0307, Appendix A, “Reactor Oversight Process Self-Assessment Metrics and Data Trending”

IMC 0308, Attachment 3, Appendix E, “Technical Basis for the Baseline Security Significance Determination Process”

IMC 0308, Attachment 6, “Basis Document for the Security Cornerstone of the Reactor Oversight Process”

IMC 0609, “Significance Determination Process”

IMC 0611, “Power Reactor Inspection Reports”

IMC 0613, “Power Reactor Construction Inspection Reports”

IMC 0801, “Reactor Oversight Process Feedback Program”

IMC 2201, “Security Inspection Program for Operating Commercial Nuclear Power 

Reactors”

IMC 2519, “Construction Significance Determination Process”

END

Attachments:

Revision History for IMC 0609, Appendix E

Attachment 1

Revision History – IMC 0609 Appendix E

Issue Date:  04/02/2110609 Appendix E