RE: Security Policy

["Fulmer, Philip" <philip.fulmer@cplc.com>]

FYI...for those who weren't able to decode the document on the NRC
Security Policy sent out earlier today, here 'tis.

Philip

_______________________

April 24, 1998	EGM 98-004

MEMORANDUM TO:	Hubert J. Miller, Regional Administrator   Region I
Luis A. Reyes, Regional Administrator   Region II
A. Bill Beach, Regional Administrator   Region III
Ellis W. Merschoff, Regional Administrator   Region IV 
Roy Zimmerman, Associate Director for Projects, NRR
Brian W. Sheron, Acting Associate Director for Technical Review, NRR
Elizabeth Q. Ten Eyck, Director, Division of Fuel Cycle Safety and
Safeguards, NMSS
Donald A. Cool, Director, Division of Industrial and Medical Nuclear
Safety, NMSS 
John T. Greeves, Director, Division of Waste Management, NMSS 

FROM:		James Lieberman, Director Office of Enforcement 

SUBJECT:  ENFORCEMENT GUIDANCE MEMORANDUM CATEGORIZING THE SEVERITY
LEVEL OF VIOLATIONS INVOLVING SECURITY AND CONTROL OF LICENSED MATERIAL

This memorandum is being issued to provide further guidance on the
severity level of violations involving 10 CFR 20.1801 and 1802, security
and control of licensed material.  The Enforcement Policy, Example
IV.C.12, indicates that a significant failure to control licensed
material is a Severity Level III violation [emphasis added].  Severity
Level III also is assigned under Example VI.C.1 for failure to control
access to licensed materials for radiation purposes as specified by NRC
requirements. 

 The following guidance uses a more risk-informed, performance-based
approach to determine the types of security violations that should be
considered significant, vs. those of less serious concern and those of
minor significance.  This guidance is intended to focus licensees=
attention on assuring a program of training, staff awareness, detection
(auditing), and corrective action (including disciplinary action) to
detect and deter security violations.  Such a program normally is not a
specific regulatory requirement, but rather a function that licensees
need to perform as an inherent part of their compliance program.
Normally, security violations that occur despite such a program will be
considered isolated.  

As with other examples in the policy, the severity level may be
increased if the violation involves willfulness, and may be increased or
decreased as other circumstances warrant.  For example, the severity
levels of some security violations that involve large amounts of very
low concentration material, such as a breach of the fencing at an SDMP
site, may be reduced if warranted by the safety and regulatory
significance of the specific violation.   

This memorandum does not address loss, release, or disposal of licensed
material, which is covered under separate examples in Supplement IV of
the Enforcement Policy.  

After gaining experience with this guidance, the staff plans to propose
that the following guidance be  incorporated as specific examples in the
Enforcement Policy.  At that time, the current examples IV.C.12 and
VI.C.1 will be withdrawn.   

Severity Level III - Violations involving, for example:

(a) failure to secure, or maintain surveillance over, licensed material
in any aggregate quantity greater than 1000 times the quantity specified
in Appendix C to Part 20, or that results in a substantial potential for
exposures or releases in excess of the applicable limits in Part 20; or
(b) failure to secure or maintain surveillance over licensed material
not characterized above and involving an aggregate quantity greater than
10 times the quantity specified in Appendix C to Part 20,  where such
failure is accompanied by the absence of, or a breakdown  in, a program
to detect and deter security violations that includes training, staff
awareness, detection (including auditing), and corrective action
(including disciplinary action).  

Severity  Level IV - Violations involving, for example:

isolated failures to secure, or maintain surveillance over, licensed
material not characterized above and involving an aggregate quantity
greater than 10 times the quantity specified in Appendix C to Part 20,
provided that:  (i) the material is labeled as radioactive or located in
an area posted as containing radioactive materials; and (ii) such
failure is non-programmatic in that the failure occurs despite a
functional program to detect and deter security violations that includes
training, staff awareness, detection (including auditing), and
corrective action (including disciplinary action).   
 
Note:  It is unlikely that licensees can eliminate all security
infractions within large, broad-licensed programs; therefore, licensees
with vigilant programs are likely to detect these violations
periodically.  The fact that security violations recur does not
necessarily mean that they are repetitive as defined in the Enforcement
Policy.  The Policy requires a consideration of whether corrective
action was taken that was reasonably calculated to prevent additional
similar violations.  If the licensee has taken reasonable corrective
action to prevent recurrence such as adopting a program of
identification, staff awareness, auditing, training, and correction of
individual security violations, normally Severity Level IV security
violations should not be considered repetitive unless they involve the
same individual(s), the same immediate supervisor, or the same workspace
(e.g., the same laboratory).  

Minor Violations  - Violations involving, for example:

Failures to secure, or maintain surveillance over:  (1) licensed
material involving aggregate quantities equal to or less than 10 times
the quantity specified in Appendix C to Part 20; or (2) properly labeled
sealed sources or waste forms measuring less than 0.02 mSv/hr (2
mrem/hr) at 30 cm. 

 	Note:  Enforcement action should not be taken against licensees for
failure to secure from unauthorized removal quantities of material less
than the quantities listed in Appendix C o f 10 CFR Part 20.  At the
present time, guidance in NUREG/CR-6204 indicates that 10 CFR 20.1801
and 1802 do not apply to amounts less than the quantities listed in
Appendix C to 10 CFR Part 20.  The staff plans to withdraw this
guidance.  When the guidance is withdrawn, this EGM will be modified to
include security issues involving quantities less than Appendix C as
minor violations.   

Security violations categorized as minor or Severity Level IV may be
dispositioned by the Regions.  For a period of three months from the
date of this EGM, security violations categorized at Severity Level III
should be coordinated with NMSS.  After that date, actions that involve
Severity Level III violations may be treated as normal delegated cases
provided that they meet the delegation criteria.

cc:	

L.  J.  Callan, EDO
A.  Thadani, DEDE
H.  Thompson, DEDR
S.  Collins, NRR
J.  Goldberg, OGC
C.  Paperiello, NMSS
The Chairman
The Commission
SECY

 
Distribution

J.  Lieberman, OE
OE Staff
(Regional Coordinators) hard copy + E-mail
NMSS Coordinator
EGM File
Day File
(WEBB 2-week delay)
PUBLIC  2-week delay)

Commission coordination paper dated April 9, 1998   

G:\EGM98004.jd


__________________________
Philip C. Fulmer, PhD, CHP 
Carolina Power & Light Company
Harris Energy and Environmental Center
3932 New Hill-Holleman Road
P. O. Box 327
New Hill, NC 27562-0327
philip.fulmer@cplc.com
(919) 362-3363      
>