1. Nuclear Security Recommendations and Guidance for Radioactive Material and Associated Facilities
International Workshop on National Registers of Radiation Sources
20 to 23 March 2017
G. Liebenberg
Division of Nuclear Security

2. Scope of IAEA publications
Code of Conduct on the Safety and Security of Radioactive Sources
Security Series: NSS 14, 11, 9, 5; NST024
Safety Standards: GSR Parts 1, 2, 3; RS-G-1.9; SSG 17 & 19
International Catalogue of Sealed Radioactive Sources and Devices.

3. Code of Conduct Designed for national governments
Provides guidance on legislation and regulations for the security of radioactive sources
Applies to “…all radioactive sources that may pose a significant risk to individuals, society, and the environment…”
These sources are listed in Annex I of the Code
They are Category 1, 2, and 3 “dangerous” sources as determined by RS-G-1.9
Cat 1
Extremely Dangerous to the Person
- permanent injury in a manner of minutes
Cat 2
Very Dangerous to the Person
- permanent injury in minutes to hours
Cat 3
Dangerous to the Person
- permanent injury in a matter of hours
Cat 4
Unlikely to be dangerous to a person
Cat 5
Most unlikely to be dangerous to a person

4. Target Audience
The Code of Conduct is designed primarily for national governments
The document provides guidance for national governments to improve their legislation and regulations for the security of sources

5. OBJECTIVES
1. to achieve and maintain a high level of safety and security
2. to prevent loss of control
& malicious use
3. to mitigate or minimize the radiological consequences of any accident or malicious act

6. Code of Conduct: Key Security-Related Provisions (1)
Effective national legislative and regulatory system of control
Regulatory body to establish and enforce security requirements
Prime responsibility for security on the operator
Requirement for license, including security plan
Security culture promotion
National registry of sources
Regular inventory controls by operator

7. Code of Conduct: Key Security-Related Provisions (2)
Threat definition and vulnerability assessment
Security measures to deter, detect, and delay theft or removal of sources
Verification of the security of radioactive sources through
Security assessments
Monitoring and verifying compliance
Maintaining appropriate records
Prompt reporting by the operator of a loss of control
Safe management and secure protection of disused sources

8. Nuclear Security Series (1)
Based on the International instruments for nuclear security
Security Fundamentals
Recommendations
Implementing Guides
Technical Guides
The Nuclear Security Series, developed in close consultation with Member States’ experts, are consistent with and complement international nuclear security instruments, and bring together best practices acceptable to the international community for broad implementation.
The Nuclear Security Guidance Committee, open to all Member States, makes recommendations on the development and review of the Nuclear Security Series.
- Talking about Nuclear Security Series in General before discussing the guidance specific to Radioactive Source Security.
As Sarah already explained the Nuclear Security Series as whole, I would just like to focus on NSS 14 (Recommendations) and NSS 11 (Implementing Guide). Mention Implementing Guide Transport Security (NSS 9)
These guidance documents are mutually supportive documents, meaning that they contain a lot of cross-references, which may make them harder to read, but gives the reader an understanding how the different parts of a security system are inter-linked. For example the security of radioactive material and an associated facility with the transport of radioactive material.
26 Documents published. 8 8

9. Nuclear Security Series (2)
Fundamentals (PRINCIPLES)
Objectives and principles
Essentials from international instruments
Recommendations (WHAT)
General approaches, actions, concepts and strategies
Applications of Fundamentals
Implementing Guides (HOW)
Ways and means on how Recommendations are to be applied and implemented at systems level
Technical Guidance (GUIDANCE)
Reference Manuals, Training Guides, Service Guides

10. Purpose - overall objectives and essential elements
NUCLEAR SECURITY FUNDAMENTALS:
‘OBJECTIVE AND ESSENTIAL ELEMENTS OF A STATE’S NUCLEAR SECURITY REGIME’
Purpose - overall objectives and essential elements
Intended for a broad audience - national policy makers, legislative, competent authorities, institutions, and individuals
Applies to all radioactive material
Aims to prevent criminal and intentional unauthorized acts involving radioactive material
- Purpose - overall objectives and essential elements
Purpose of NSS No.20 is to
- set out overall objectives of a national nuclear security regime and to
- establish the set of essential elements of an appropriate and effective national nuclear security regime
- Intended for a broad audience - national policy makers, legislative, competent authorities, institutions, and individuals
The Nuclear Security Fundamentals document is intended for national policy makers, legislative, competent authorities, institutions, and individuals involved in the formation, maintenance or enhancement of a national nuclear security regime
- Applies to all radioactive material
The Fundamentals document is intended to apply to all radioactive material – which is nuclear material or other radioactive material, whether it is under or out of regulatory control, throughout its lifetime and the associated facilities and associated activities
- Aims to prevent criminal and intentional unauthorized acts involving radioactive material
It provides general recommendations and guidance for the protection of persons, property, society and the environment from criminal and intentional unauthorized acts involving nuclear material or other radioactive material 10

11. Nuclear Security Series No. 14
Provides guidance to States and competent authorities on establishing a nuclear security regime for radioactive material, including radioactive sources
Complements NSS 20 and Code of Conduct

12. Nuclear Security Series No.14
Elements of a States (Nuclear) Security Regime
State Responsibility
Assignment of (nuclear) security responsibilities
Legislative and Regulatory Framework
State
Regulatory Body
Operator, shipper and/or carrier
International Cooperation and Assistance
Identification and Assessment of Threats
These Recommendations provide high level guidance to States and competent authorities on how to develop or enhance, to implement or to maintain a nuclear security regime for radioactive material, associated facilities and associated activities.
It defines the objectives of a State’s nuclear security regime for these types of materials, facilities and activities and it defines and describes the key elements of the nuclear security regime. Finally, it provides broad recommendations for security to meet the objectives.
It is intended that the Technical Guides will provide more detailed and specific information on key topics within these Recommendations.

13. Nuclear Security Series No.14
Risk based nuclear security systems and measures
Risk Management
Interfaces with safety system
Sustaining the nuclear security regime
Planning and preparedness for and
response to an event
Import and Export of radioactive material
Detection of nuclear security events
These Recommendations provide high level guidance to States and competent authorities on how to develop or enhance, to implement or to maintain a nuclear security regime for radioactive material, associated facilities and associated activities.
It defines the objectives of a State’s nuclear security regime for these types of materials, facilities and activities and it defines and describes the key elements of the nuclear security regime. Finally, it provides broad recommendations for security to meet the objectives.
It is intended that the Technical Guides will provide more detailed and specific information on key topics within these Recommendations.

14. Nuclear Security Series No.11
IAEA Security of Radioactive Sources Implementing Guide (Nuclear Security Series No. 11) provides guidance to States on developing regulations for the security of radioactive sources
This recommended approach is summarized on the following slide
Revision approved for publication in late 2016; publication expected in early 2018

15. Three Step Process in NSS No. 11
Establish graded security levels with corresponding goals and sub-goals for each security level
Specify the security level applicable to given sources
Select and implement a regulatory approach: prescriptive, performance-based, or combined

16. Step 1: Establish Graded Security Levels
NSS No. 11 recommends the following security levels and associated Goals:
Security Level A: prevent unauthorized removal of a source (timely detection and response)
Security Level B: minimize the likelihood of unauthorized removal of a source (immediate detection of the unauthorized removal, but not requiring a response to interrupt the act)
Security Level C: reduce the likelihood of unauthorized removal of a source
Security Regulations

17. Step 1: Establish Graded Security Levels
NSS No. 11 further recommends establishing a set of Security Objectives
For each of the security functions: Detection, Delay, Response, and Security Management
For each Security Level A, B, and C
These Objectives state the desired outcome from the combination of measures applied to meet the objective
For example, the Delay Objective for Security Level A is: provide delay after detection sufficient to enable response personnel to interrupt the unauthorized removal
The complete set of recommended Security Objectives for each security level is in Table 2 of NSS No. 11
Security Regulations

18. NSS No. 11, Table 2 Detection Delay Response Security Management
Security Levels Goals
Objectives for meeting each goal with respect to
Detection
Delay
Response
Security Management

19. Step 2: Specify the Security Level Applicable to Given Sources
The security level for a given source should correspond to the potential harm the source could cause if used in a malicious act
A starting point is the categorization system used in the Code of Conduct and presented previously
The Guide notes that as a default arrangement, the regulatory body could use these categories to assign the security level applicable to a given source, as set forth in Table 5 of NSS No. 11
Security Regulations

20. NSS No. 11, Table 5
Security Regulations

21. Step 2: Specify the Security Level Applicable to Given Sources
NSS No. 11 further recommends that the regulatory body pay special attention to the following factors when assigning security levels to radioactive sources:
Attractiveness (e.g., chemical and physical form, nature of radioactive emissions, ease of handling, collocation, perceived economic value)
Sources in temporary storage
Vulnerability and threat level
Mobile, portable, and remote sources
These considerations could lead to adjustment of the assignment of sources to security levels in Table 5
Security Regulations

22. Step 3: Select and Implement a Regulatory Approach
NSS No. 11 explains that there are three alternative approaches for directing operators how to demonstrate they meet the Security Objectives
Prescriptive approach
Performance-based approach
Combined approach
Security Regulations

23. Step 3: Select and Implement a Regulatory Approach: Prescriptive Approach
Regulatory body establishes specific required security measures for each security level
NSS No. 11 provides recommendations for such required measures using a prescriptive approach in Tables 6, 7, and 8
Provides simplicity in implementation for both the regulatory body and operator
Limited flexibility to address actual, non-standard situations
Security Regulations

24. NSS No. 11, Table 6, 1 of 2 Security Function Security Objective
Security Measures
Detect
Provide immediate detection of any unauthorized access to the secured area/source location.
Electronic intrusion detection system and/or continuous surveillance by operator personnel.
Provide immediate detection of any attempted unauthorized removal of the source, including by an insider.
Electronic tamper detection equipment and/or continuous surveillance by operator personnel.
Provide immediate assessment of detection.
Remote monitoring of CCTV or assessment by operator / response personnel.
Provide immediate communication to response personnel.
Rapid, dependable, diverse means of communication such as phones, cell phones, pagers, radios.
Provide a means to detect loss through verification.
Daily checking through physical checks, CCTV, tamper indicating devices, etc.
Delay
Provide delay after detection sufficient for response personnel to interrupt the unauthorized removal.
System of at least two layers of barriers (e.g. walls, cages) which together provide delay sufficient to enable response personnel to interdict.
Response
Provide immediate response to assessed alarm with sufficient resources to interrupt and prevent the unauthorized removal.
Capability for immediate response with size, equipment, and training to interdict.
Security Regulations

25. NSS No. 11, Table 6, 2 of 2 Security Function Security Objective
Security Measures
Security Management
Provide access controls to source location that effectively restrict access to authorized persons only.
Identification and verification, for example, lock controlled by swipe card reader and personal identification number, or key and key control.
Ensure trustworthiness of authorized individuals.
Background checks for all personnel authorized for unescorted access to the source location and for access to sensitive information.
Identify and protect sensitive information.
Procedures to identify sensitive information and protect it from unauthorized disclosure.
Provide a security plan.
A security plan which conforms to regulatory requirements and provides for response to increased threat levels.
Ensure a capability to manage security events covered by security contingency plans.
Procedures for responding to security-related scenarios.
Establish security event reporting system.
Procedures for timely reporting of security events.
Security Regulations

26. Step 3: Select and Implement a Regulatory Approach: Performance-Based Approach
Regulatory body establishes a required level of security system performance against the threat for each security level (such as the recommended goals in NSS No. 11)
Operator designs a security system that provides that level of performance defined by the regulatory body
Allows each operator to address their own circumstances
Potentially more cost-effective for the operator than the prescriptive approach
Requires both regulatory body and operator to have relatively high levels of security expertise
Security Regulations

27. Step 3: Select and Implement a Regulatory Approach: Combined Approach
Includes elements drawn from both prescriptive and performance based approaches
Allows regulatory body greatest flexibility
For example, the regulatory body might apply performance-based approaches for higher activity sources and a prescriptive approach for lower activity sources
Security Regulations

28. Thank you!
Thank you!