ANNEX

1. Heading 1: Priority and Cross-Cutting Projects in Nuclear Security Project 1: Universalisation of the 2005 Amendment to the Convention on the Physical Protection of Nuclear Material (ACPPNM) Background With the aim of facilitating the adherence to and implementation of the Amendment, the IAEA provides legislative and technical assistance upon request. This includes: 1. Assistance in the drafting of national implementing legislation, including the provision of national, regional and international training courses and seminars, bilateral assistance in drafting national laws and training of individuals. 2. Assistance in establishing, implementing, and maintaining a State’s physical protection regime, including the provision of nuclear security services, such as peer reviews and advisory services, national and regional training courses and workshops aimed at capacity building and the development of the necessary human resources and developing and implementing Integrated Nuclear Security Support Plans (INSSPs). Objectives The objectives will be to assist in the development and promotion of nuclear security globally, including the production and relevant use of guidance in the IAEA Nuclear Security Series, to promote the universalisation of the Convention on Physical Protection of Nuclear Material (CPPNM) and its Amendment, together referred to as A/CPPNM, and to facilitate information exchange on nuclear security and strengthening the international legal framework. Deliverables 1. ACPPNM review at the 2021 Conference of States Parties. 2. International, Regional and National workshops – upon request from Member States – to promote the universalisation of CPPNM and raise awareness. 3. Development of outreach material to encourage further adherence to the ACPPNM. Outcome IAEA contributions to adherence to the A/CPPNM Project 2: Computer Security and Information Technology Services Background Information and computer security continues to be a critical element for States in improving their nuclear security capabilities. Nuclear security focuses on the prevention of, detection of, and response to, criminal or intentional unauthorised acts involving or directed at nuclear material, other radioactive material, associated facilities, or associated activities. The responsibility for nuclear security within a State rests entirely with the State, which has to ensure the security of nuclear material, other radioactive material, associated facilities, and associated activities under its jurisdiction. Each State aims to achieve nuclear security by creating its own nuclear security regime appropriate to that State. Computers play an essential role in all aspects of the management of safe and secure operation of nuclear facilities, including computer security and maintaining physical protection. It is vitally important that all such systems are properly secured against malicious intrusions. With the ever changing threat capabilities and attributes, information and computer security is continually evolving and new threat techniques, tactics and processes are continually emerging. The IAEA conducts work aimed at defending against this evolving threat. Objectives To improve computer security and information security capabilities in States. Deliverables 1. Complete and maintain up-to-date information and computer security guidance publications in the IAEA Nuclear Security Series (New and updated guidance documents) and related technical documents and publications. 2. Hosting of expert meetings specific to the computer security of nuclear facilities to stay abreast of developments in this area. 3. Training courses, exercises and workshops. 4. Technical assistance provided to States in computer security. Outcome 1. IAEA contributions to improved information and computer security capabilities at the State, competent authority, and facility levels to support the prevention and detection of, and response to, computer security incidents that have the potential to either directly or indirectly adversely impact nuclear safety and security. 2. Improving international cooperation by bringing together experts and policy-makers to promote the exchange of information and experiences in computer security. 3. Maintain guidance and technical document publications in the area of information and computer security for nuclear security. Project 3: Enhancing Nuclear Security Culture Background Nuclear security culture is a multidisciplinary approach to prepare the workforce against threats from both outside and inside with their willingness and motivation to follow established procedures, comply with regulations and show vigilance. As most nuclear security systems are human-designed, -managed, and –operated, ultimately, the success of the nuclear security regime depends on the people involved. Nuclear security culture is identified as one of 12 fundamental principles for physical protection of nuclear material and facilities in the ACPPNM as well as one of basic principles in the Code of Conduct on the Safety and Security of Radioactive Materials. The Implementing Guide on Nuclear Security Culture, NSS No 7 defines nuclear security culture as the assembly of characteristics, attitudes and behaviour of individuals, organisations and institutions, which serves as a means to support and enhance nuclear security. NSS No 7 defines the concept, describes the roles and responsibilities of institutions and individuals, and provides characteristics of nuclear security culture that serve to achieve effective nuclear security. The project focuses on supporting Member States’ human resource development through workshops, training courses and awareness raising seminars, supporting the conduct of nuclear security culture self-assessment and promoting experience and knowledge-sharing on self-assessment tools and methodologies and nuclear security culture good practices. Objective To assist States in enhancing their security culture. Deliverables 1. Organisation of international workshops on nuclear security culture to support Member States’ human resource development. 2. Development and consolidation of nuclear security culture guidance and training material and tools, including self-assessment tools. Outcome Promoting international exchanges of experience, knowledge and good practices as regards ways to develop, foster and maintain a robust nuclear security culture compatible with States’ nuclear security regimes.

2. Heading 2: Information Management Project 1: Assessing Nuclear Security Needs, Priorities and Threats (INSSP missions) Background The IAEA assists individual States that so request to identify and address nuclear security needs through the development and implementation of INSSPs and the development of self-assessment tools. The responsibility for nuclear security within a State rests entirely with the State, which has to ensure the security of nuclear material, other radioactive material, associated facilities, and associated activities under its jurisdiction. The IAEA supports States’ efforts to establish effective and sustainable nuclear security regimes, and the INSSP is an effective mechanism in this regard. The INSSP is a non-legally binding document, however its approval or endorsement by the State is considered to be indicative of a commitment to pursue the implementation of agreed nuclear security improvements contained therein. The INSSP is designed to help strategic planning of nuclear security activities in a State and to ensure a State’s ownership of the improvements required to strengthen its nuclear security regime. It provides an assessment of the State’s nuclear security needs and captures activities being undertaken, or planned to be undertaken, by a State and in cooperation, where appropriate, with the IAEA or other international partners. The INSSP is organised in a general framework of nuclear security areas and objectives that provide a systematic approach for the State to identify its nuclear security needs. The intent is to provide a State with general nuclear security elements of a strategic nature to help in guiding decision makers and strategic planning objectives with a long-term view to establishing self-sustaining nuclear security regimes. The INSSP is structured around six functional areas: (1) Legislative and Regulatory Framework; (2) Threat and Risk Assessment; (3) Physical Protection Regime; (4) Detection of criminal and other unauthorised acts involving material out of regulatory control; (5) Response to nuclear security events; and (6) Sustaining a State’s nuclear security regime. In addition to INSSP missions, the IAEA also organises Technical Meetings of the INSSP Points of Contact. The INSSP process is supported by Nuclear Security Information Management System (NUSIMS), a voluntary system designed to assist Member States in reviewing the status of their nuclear security infrastructure through Self-Assessment, as well as in tracking their progress towards establishing, maintaining and sustaining an effective nuclear security regime. The information structure of NUSIMS reflects core operational Nuclear Security Areas (NSAs) and is based on the Nuclear Security Fundamentals and Recommendations publications issued within the IAEA Nuclear Security Series. Objectives Identify and consolidate the nuclear security needs of individual States into an integrated document that includes the necessary nuclear security improvements, as well as to provide a customised framework for coordinating and implementing nuclear security activities conducted by the State, the IAEA and potential donors. Maintain a comprehensive information platform providing a good understanding of nuclear security needs of States globally and supporting the implementation of the Nuclear Security Plan. Deliverables 1. Development and implementation of INSSPs. 2. Review and re-alignment with INSSP structure of voluntary self-assessment mechanism or tool for States’ use (NUSIMS). 3. Technical Meetings of INSSP Points of Contact. 4. Finalisation of the INSSP User Manual. Outcome Assessment of requesting States’ nuclear security needs, and provision of support by establishing strategic planning of recommended nuclear security activities to ensure establishment, maintenance and sustainability of an effective nuclear security regime to help States with adherence to A/CPPNM obligations.

3. Heading 3: Nuclear Security of Materials and Associated Facilities Project 1: Enhancing Physical Protection and Nuclear Material Accounting and Control for the Whole Fuel Cycle Background Activities related to nuclear security of nuclear material in use and storage, nuclear security of the nuclear fuel cycle and associated facilities during their life-time, including accounting and control of nuclear material for nuclear security purposes, and technical implementation of the A/CPPNM. The Agency develops guidance and provides training and assistance to States, upon request, for enhancing nuclear materials security using accounting and control. The project will focus on addressing ‘insider threat’. The IAEA Insider Threat Programme provides guidance on preventive and protective nuclear security measures to mitigate the insider threat. The project will also address nuclear material accounting and control (NMAC). An NMAC system helps to deter and detect unauthorised removal of nuclear material by maintaining an inventory of all nuclear material, including information related to its location. The primary objective of an NMAC system is to maintain and report accurate, timely, complete and reliable information on all activities and operations (including movements) involving nuclear material. The NMAC system at the facility level is established within the context of a national regulatory framework and is controlled by the State’s competent authority. It is not to be confused with a State’s System of accounting for and control of nuclear material (SSAC) established to meet international safeguards obligations. The IAEA has invested significant resources to develop the hypothetical Shapash Nuclear Research Institute (SNRI). The main purpose for the development of SNRI was to be able to train Member States on Nuclear Security related issues without divulging sensitive information about actual facilities and risk compromising their security. The SNRI 3D model is a useful tool for Nuclear Security training purposes. Further developing SNRI is expected to leverage the power of the 3D model and improve Nuclear Security training outcomes. However, using 3D and VR for training purposes requires specialised knowledge and resources. Training objectives need to be closely matched to the technological solutions used to achieve them. The IAEA intends to further explore the potential strengths of the SNRI 3D model and sustain development of educational material related to SNRI in the future. Objectives To provide guidance and tools for preventing and protecting against unauthorised removal of nuclear material and sabotage of nuclear material and facilities by insiders. To assess which IAEA Member States that process, handle or store nuclear material are using an NMAC system and provide assistance to their competent authorities and operators to ensure a successful NMAC Programme. To assess which IAEA Member States that currently do not have an NMAC system would like to request assistance in establishing an NMAC Programme. Deliverables 1. Production of Nuclear Security Series guidance publications and e-learning tools on countering the insider threat and enhancing material accounting and control for nuclear security purposes at facilities 2. Organisation of awareness and practical training courses. 3. Organisation of awareness and practical training courses on NMAC. 4. Further development of the Shapash virtual reality (VR) training tool. Outcome Continued provision of support to assist States’ efforts to establish effective and sustainable national nuclear security regimes that support countering the insider threat and enhancing accounting and control for nuclear security purposes at facilities Project 2: CRP Concept Paper on the application of physical protection measures in the age of COVID-19 Background This project will address the application of access control and other nuclear security technologies in the pandemic environment at facilities storing and using nuclear and other radioactive material, including nuclear fuel cycle facilities, research and power reactors, and radioactive material facilities. During a COVID-19-like pandemic, medical measures intended to minimise the transmission of the virus may affect the effectiveness and even the application of the existing nuclear security technologies and procedures such as personnel access control measures. Changes in implementation protocols, modification of the existing technologies, and adaptation of new technologies may be appropriate in some settings to overcome challenges due to COVID-19. The project will review the IAEA Member States’ operating experience of using access control and other nuclear security measures during COVID-19 and identify the associated challenges and good practices. It will then seek to identify nuclear security technologies and procedures (including in the area of access control) in need of improvement and conduct laboratory evaluations of potential modifications and improvements from the standpoint of their implementation under COVID-19 like conditions. IAEA will facilitate exchange of operating experience and technical information among Member States, publish the project-related reports, and support the conduct of research work in selected Member-State laboratories. Objectives The project will seek to ensure effective nuclear security measures at nuclear and other radioactive materials facilities during a COVID-19-like situation. Specifically, the project’s objectives include the following: 1. Review Member States’ operating experience of implementing access control and other nuclear security measures during COVID-19. 2. Identify the associated challenges and good practices. 3. Consider the need in modification of the existing technologies or the procedures associated with their use, or development of new technologies to account for the medical requirements associated with COVID-19. 4. Conduct a technical assessment of the proposed modifications of newly-developed access control and other nuclear security technologies to account for pandemic conditions. Deliverables 1. Good practices and technology recommendations guide to share Member States’ operating experience in nuclear security during COVID-19. 2. Identification of technology areas that need further development to enable effective access control and other nuclear security measures under COVID-19-like conditions. Outcomes Enhanced nuclear security measures to prevent theft or sabotage of nuclear and other radioactive material and facilities during pandemic-like situations. Improved decision making by regulatory bodies and industry concerning implementation of access control and other nuclear security technologies during crisis.

4. Heading 4: Nuclear Security of Materials Out of Regulatory Control Project 1: Institutional Response Infrastructure for Material Out of Regulatory Control Background The project provides assistance to Member States, upon request, in their efforts to establish the necessary infrastructure to combat illicit trafficking in nuclear and other radioactive material. The support for infrastructure under the project is divided into service to identify infrastructure needs and support to States to establish, implement, monitor, assess, and sustain their nuclear security regime related to the response to nuclear security events involving material out of regulatory control. A State’s infrastructure needs are assessed through either the IAEA International Nuclear Security Advisory Service (INSServ) process, or through the development of a Nuclear Security Response Roadmap. An additional area of responsibility is in the provision of support to States who wish to implement nuclear security systems and measures for Major Public Events (MPEs). Objective To assist States in establishing and sustaining an effective institutional infrastructure to strengthen national efforts to protect people, property, the environment and society from the unauthorised use of nuclear and other radioactive material. Deliverables 1. Development of guidance publications for nuclear security infrastructure and related training material and tools. 2. Provision of support to States, upon request, with building human and technological capacity to maintain an effective infrastructure to discharge their responsibilities related to nuclear and other radioactive material out of regulatory control. 3. Coordination of support for response working group. 4. Provision of IAEA support on implementation of nuclear security measures for MPEs. Outcomes IAEA contributes to increased awareness of the need for an effective institutional infrastructure in a State to ensure national and international obligations are met. States have an in-depth understanding of the strengths and areas for development of their MORC (Material Out of Regulatory Control) related nuclear security regime. States have a clear time-based plan for the development of their MORC response capabilities.

5. Heading 5: Programme development and international cooperation Project 1: Education and Training Programme Development Background The Agency plays an important role in the provision of coordinated education and training programmes that strengthen capabilities in States to establish and sustain nuclear security regimes. Sufficient numbers of competent and motivated personnel is one of the important prerequisites to establish and sustain States’ nuclear security regimes. Training is an important means to achieve the competence and adequate performance of personnel. The IAEA assists States by providing training based on States’ requests and needs as well as supporting the establishment of nuclear security training programmes and training organisations including Nuclear Security Support Centres (NSSCs). The Systematic Approach to Training (SAT) is a training approach that provides a logical progression from the identification of the knowledge, skills and attitudes required to perform a job or role in nuclear security to the development and implementation of training to achieve these competencies, and subsequent evaluation of this training. The use of e-learning and other computer training tools, will be a particular focus under this project. This project is not limited to the development of education and training, but also involves coordination of networks such as the International Nuclear Security Education Network (INSEN) and the International Network for Nuclear Security Training and Support Centres (NSSC Network). Objectives The purpose of this project is promote an integrated approach to human resource development in the field of nuclear security, and to assist States in building their capacity to develop and implement effective and sustainable educational and training programmes for human resource development in nuclear security, based on identified needs. To build stronger cooperation and facilitate increased information exchange among States on the development and implementation of education and training programmes for nuclear security through the INSEN and the International NSSC Network and the Nuclear Security Information Portal (NUSEC). Deliverables 1. Human resources development methodology for nuclear security shared with and used by States. 2. Leadership Academy for Nuclear Security established. 3. Experience and good practices in nuclear security training shared. 4. Support to Member States in application of SAT methodology provided. 5. Support in undertaking continuous, regular training needs analysis (TNA), evaluation of training, and establishment of training committees provided. 6. Support for and coordination of NSSC Network activities, to facilitate sharing of information and resources and to promote cooperation among States with an NSSC or those having an interest in developing a centre. 7. Provision of assistance to States in establishing and operating NSSCs to sustain national nuclear security regimes through programmes in human resource development, technical support and scientific support. 8. Support for regional and sub-regional cooperation among States with planned or operational NSSCs. 9. INSEN. 10. Master’s Programme in Nuclear Security. 11. Schools on Nuclear Security 12. Faculty Development Courses on Nuclear Security Education. 13. Teaching Materials for Nuclear Security Education Programmes. 14. Production of e-learning courses in all official IAEA languages, including translation. 15. Revision of legacy e-learning courses including revision of translation. Outcome States are able to effectively initiate and implement measures to sustain their national nuclear security regimes, in particular, through programmes in human resource development, education, training, technical support, and scientific support.