This supplementary guidance is intended to assist members of an IPPAS
team to identify and acquire the information they need to develop
and produce satisfactory technical notes. The reference document on
which the reviews should be based is INFCIRC/225 (supplemented by
IAEA-TECDOC-967 and INFCIRC/274/Rev.1).
There may be areas where review questions infringe on matters which
are nationally sensitive (e.g., threat data). It is not necessary
that the IPPAS team have detailed information on such matters, but
merely to ascertain that they are addressed.
Each review area is subdivided into "Objectives", "Documentation"
and "Review points/specimen questions". The documentation lists the
relevant preliminary background information that the IAEA will have
requested from the Member State prior to the mission and further documentary
information (which may not be required in English translation) that
should be made available during the course of the mission. The review
points/specimen questions are intended only to act as pointers; they
should not be taken as all-encompassing or definitive, and must not
be considered as a constraint on the reviewer, who should use judgement
regarding their usefulness/applicability in any particular Member
This guidance is intended to promote thought rather than to be prescriptive
and should be used to encourage self-examination on the part of the
competent authority, the licensee and their staff; the review points/specimen
questions should not be used as a Yes/No checklist.
Supplementary IPPAS guidance have been developed in the following
- Governmental organization and pertinent nuclear physical protection legislation
- Role and responsibility of the competent
- Regulations and guidance
- Licensing procedures
- Integration and participation of other organizations
- Facility and nuclear transport implementation of physical protection
- Inspection and enforcement procedures(including sanctions).
II-1. Governmental organization and pertinent nuclear physical protection
These are the fundamental bases on which the responsibility for the
establishment, implementation and maintenance of physical protection
of nuclear material and nuclear facilities rest within the Member
State. Governments need to discharge their responsibilities to regulate
the physical protection of nuclear material in order to protect nuclear
material from theft, and site personnel, the public and the environment
from undue radiological risk as a result inter alia, of an unauthorized
use of nuclear material and sabotage. The Member State therefore needs
to have an adequate and supportive governmental organization and legislation.
The legislation should provide for a competent authority, which must
have sufficient staff, powers and funding to perform its duties and
the freedom to do so without undue interference. The government aim
at improving the physical protection of nuclear material while in
international transport and seek to minimize any impediments to such
exchanges. In addition, the State should establish mechanisms to provide
for the co-operation for the recovery and protection of stolen nuclear
In order to allow time for a comprehensive consideration of these
fundamental issues, the background information necessary to enable
team members to begin to formulate views on this area will need to
be provided in advance by the Member State.
The State should establish (e.g., through the enactment of national
legislation) a system for the physical protection of nuclear material
and facilities within which the physical protection competent authority
is established and can operate effectively and, inter alia, has adequate
powers and sufficient funds for its activities, and can pursue its
regulatory task without undue interference.
The Member State should ensure an adequate hierarchy of authority
and responsibility to enable the competent authority to fulfil its
physical protection functions. In particular, the competent authority
should be separated in the governmental organization from the bodies
responsible for developing and promoting the use of nuclear energy
or operating nuclear installations
- Primary legislation: laws enacted by the State legislative body (e.g., the congress/parliament/local
legislatures and ordinances);
- Secondary legislation, subsidiary/lower tier laws (e.g.,legislative regulations issued by the government or administrative agency/body pursuant to primary legislation);
- Conditions included in licences, etc., issued by the competent authority;
- Description of the constitutional and legal system of the Member State;
- Description of all the government ministries or departments involved in physical protection, their responsibilities and how they interrelate, e.g., overall co-ordination mechanisms.
II-1.3. Review points/specimen questions
- What are the numbers and types of facilities and/or activities that the Member State is operating or planning to operate in the following areas:
- Nuclear power plants;
- Research reactors, experimental reactors and critical assemblies;
- Fuel processing and manufacturing plants;
- Fuel reprocessing plants;
- Waste management and spent fuel storage facilities;
- Transportation of nuclear materials;
- Any other facility associated with civil nuclear energy;
- Other nuclear facilities being planned?
- What is the principal legislation (laws, ordinances, decrees or other legally binding provisions) which establish the State physical protection system? Is this body of legislation satisfactory and does it require appropriate administrative and technical measures for the physical protection of nuclear material and nuclear facilities as a prerequisite for obtaining a licence?
- Describe how the current legislation requires the establishment of a competent authority or bodies with responsibilities for comprehensive governmental regulation of all aspects of physical protection of nuclear material and nuclear facilities.
- Provide a diagram showing the governmental organization(s) for the oversight of the facility operators program of physical protection. It should make clear the reporting lines of the various authorities or bodies within the legislative framework. It would be helpful to distinguish between direct lines of control and lines which show where advice is given and/or received.
- Does the current legislation require the competent authority to issue physical protection secondary legislation? If not the competent authority, then who does?
- Are there any undue impediments to the necessary amendment of secondary legislation?
- Does the current legislation require the preparation of periodic reports on the physical protection of nuclear facilities, and if so, by whom? If yes, to whom are these reports addressed?
- Does the legislation make compliance with the States physical protection legislation a prerequisite for nuclear activities to be licenced?
II-2. Role and responsability of the competent authority
The primary responsibility of the competent authority is to ensure that nuclear material is protected, inter alia, from theft and that site personnel, the public and the environment are protected from possible injury arising from the unauthorized removal of nuclear material or the consequences arising from acts of sabotage. To fulfil its responsibilities the competent authority needs to have sufficient powers:
- To have a clearly defined legal status and independence from the applicant(s)/licensee(s): to have enough authority to enable it to perform its responsibilities and functions effectively.
- To establish a system to define acceptable levels of physical protection; to monitor the licensees to ensure that they fulfil their physical protection responsibilities; to reassess physical protection levels and ensure that the licensees provide appropriate levels of physical protection.
- To establish clear regulatory objectives, and to understand how these are achieved and how they compare with international standards and good practices. The competent authority will also need to establish a system for effective interaction, liaison and co-operation system with other nuclear regulatory bodies within and outside of the State and with international bodies and organizations.
All staff of the competent authority should clearly understand the legal authority underpinning their activities, and how this governs their activities in planning, assessing, licensing, inspecting, enforcing, etc.
In exercising their authority in matters of physical protection, all staff of the competent authority should understand their organization's regulatory role and objectives, how these are achieved and how they compare with international standards and good practices.
The competent authority should establish any necessary arrangements for co-ordination with other regulatory organizations and those responsible for national security, response force co-ordination, and other affiliated agencies to ensure an integrated approach to physical protection.
- Description of the competent authority's legal status, responsibilities and its objectives as defined by law; and
- Description of how the competent authority co-ordinates, liaises with and relates to each of the other government ministries, departments or other organizations involved with physical protection.
II-2.3. Review points/specimen questions
- What are the statutory responsibilities of the competent authority?
- Is the statutory responsibility of the competent authority institutionally separate from that of the applicant(s)/licensee(s)? If not, what is the relationship?
- If the competent authority comprises more than one organization (e.g. national and State bodies), what is the relationship between these bodies having responsibility for physical protection of nuclear material and nuclear facilities?
- Does the competent authority possess the following powers for regulatory licensing, inspection and enforcement:
- To establish and issue binding regulations, requirements and standards which, among other things, serve as the basis for inspection;
- To enter at any time for inspection purposes the premises of any nuclear facility or related vendor establishment;
- To require preparation of and access to within a reasonable time such reports and documents from applicant(s)/licensee(s) and their vendors as are essential for the performance of its inspection responsibilities;
- To require the co-operation and support of each of the various governmental bodies and consultants possessing inspection related competence or qualifications;
- To communicate to authorized organizations inspection information, findings, recommendations and conclusions;
- To require licensees to promptly inform the competent authority of conditions, events or developments which could affect the secure operation of nuclear facilities; and
- To require licensees to comply within a reasonable period of time with all decisions and enforcement actions of the competent authority?
- To apply appropriate sanctions to responsible persons (e.g., licensees) in case of non-compliance with the legislation on physical protection.
- If any answers under (d) are yes, identify the principal laws, ordinances, decrees or other legal provisions that confer the authority.
- What are the competent authority's responsibilities for informing other relevant governmental organizations and the public of regulatory activities and physical protection related issues? How are these responsibilities discharged?
- What are the competent authority's international contacts in the field of physical protection for:
- exchange of information;
- notification of criminal incidents or abnormal occurrences; and
- mutual assistance in the event of a nuclear related incident (e.g., co-operation the recovery and protection of stolen material)?
- Are these contacts based upon formal exchange agreements or are they on an ad hoc basis?
- At what levels are international contacts made?
- Does the competent authority actively participate in the activities of international organizations?
- Are the competent authority's physical protection objectives clearly stated and readily understandable? Do they strike a good balance between being too general and too prescriptive, and between innovation and reliance on proven techniques?
- Has the budget for the competent authority kept pace with inflation and the growth of the industry? Is funding sufficient to allow the employment of staff of adequate competence?
II-3. REGULATIONS AND GUIDANCE
The competent authority needs to establish a clear framework of requirements with which applicant(s)/licensee(s) should comply and to provide guidance amplifying how regulatory obligations may be fulfilled. Detailed regulations and guides are not obligatory for all situations. The competent authority may consider it appropriate to develop them in step with the development of the national nuclear programme.
The competent authority should endeavour to ensure that regulations, codes, guides, etc. (see Section II-1.2) explicitly address the possibilities for unauthorized removal of nuclear material or for sabotage as the main reason for their issuance.
The competent authority should establish a clear policy regarding the approach taken to elaborate regulations and guides. This policy should be developed to suit both the licensing system and the governmental structure of each Member State.
The competent authority should ensure that an applicant/licensee is made aware of regulations and guides that are applicable. The applicant(s)/licensee(s) should have the opportunity to comment during the elaboration process (drafting) of regulations and guides
List of all relevant regulations, guides, codes or technical standards that are required to be used or complied with by the applicant(s)/licensee(s).
II-3.3. Review points/specimen questions
- What is the hierarchy of regulations and guides that are to be used by the applicant(s)/licensee(s)?
- What system of consultation with independent bodies and/or applicant(s)/licensee(s) is in place to obtain feedback on codes or guides produced by the competent authority? Is this voluntary or required by legislation?
- What system of internal scrutiny and assessment has the competent authority established to confirm the adequacy of any code or guide prior to its implementation?
II-4. Licensing process
While responsibility for implementation of physical protection rests with each applicant/licensee, the competent authority exercises control and oversight, inter alia, at all stages of the life of nuclear installations primarily through the licensing process. Hence, the primary task of the competent authority is to consider whether to approve (or not) applications for new licences, renewals or amendments to existing licences. The competent authority should issue a licence only when the activities comply with the State physical protection legislation. The licence itself should be an official document authorizing an activity or activities including approval of the licensees’ physical protection plan.
Licence conditions need to be kept as a live issue throughout all stages of the life of a nuclear installation. The licence may be changed or modified as circumstances dictate but always by and under the control of the competent authority.
The competent authority should ensure that any licence are issued only if:
- In compliance with the relevant national legislation;
- Accurately specifies the activity or activities to be licenced; and
- Clearly identifies any conditions regarding the activities, i.e. requirements, limitations or constraints.
The competent authority should ensure that it has received, and assessed, adequate documentary evidence from each applicant/licensee regarding the physical protection plan for activity or activities to be licenced before the licence is issued
Any change to a licence should be controlled by the competent authority to ensure that the change receives appropriate levels of consideration and assessment before being implemented.
- Description of the requirements placed on an organization to whom a licence can be granted;
- Description of the general licensing philosophy of the competent authority, e.g. prescriptive or non-prescriptive; and
- Description of the particular function(s) of a licence in the Member State, how it is granted and who grants it; identify whether one or more licences is or are required for a nuclear installation and/or activity as described in II-1.3(a), which stages of the licensing process they cover and whether they are time or event limited.
II-4.3. Review points/specimen questions
- What are the statutory responsibilities of licensees?
- What documents relating to physical protection measures should be submitted as part of the licence application?
- Which area(s) of the government organization is competent to grant licences and what are the principal prerequisites for granting a licence?
- Are there any other special features which have a bearing on the licensing process?
- What are the main requirements of a licence for each type of nuclear facility or activity described in II-1.3(a)?
- Is a licence specific to one facility or can it apply to a site with more than one facility?
- Do licences have restrictions, duties on the licencee or time limits for its validity and, if so, what are they? If not, explain the reasons for not having such limits?
- How does the competent authority control any proposed changes to a licence? What system is in place to ensure that such a change receives appropriate consideration and assessment before being implemented?
- Does the competent authority initiate independent analyses (e.g. technical system testing,computer modelling)?
- What programme of review and assessment is carried out by the competent authority prior to the granting of a licence for the commencement of construction of a nuclear facility?
- What programme of review and assessment is carried out by the competent authority during construction and commissioning of a nuclear facility?
- How does the competent authority review submissions from licensees for modifications during the operational phase of the nuclear facility? Does the competent authority require periodic physical protection reviews during the operation of the nuclear facility? If so, what period of time is allowed between reviews?
- What requirements are in place for approval of modifications to a nuclear facility that could affect physical protection systems?
II-5. Integration and Participation of other organizations
The State System of Physical Protection will encompass not only physical protection regulations and the relevant competent authorities but also the participation of other State organizations, agencies and official bodies. Their participation in the system will be essential to ensure:
- The threat is assessed, kept up to date and communicated to those regulatory bodiesand authorities responsible for the arrangements for the physical protection of nuclear materials and facilities.
- Response forces with the necessary authority, established by the State’s constitution or statutory laws, are made available to respond to incidents which could threaten nuclear material and nuclear facilities and that these response forces are exercised in their role.
- That the responsibility for recovery and protection of stolen nuclear materials is clear.
- That adequate co-operation and assistance mechanisms for such recovery and protection of stolen material are in place.
The State should establish a clear policy and procedures to ensure that State bodies, agencies and other official organizations provide the necessary support for the physical protection of nuclear materials and to counter sabotage
II.5.2. Review points/specimen questions
- How does the competent authority co-ordinate, liaise or consult with the governmental or other bodies having responsibility for each of the following:
- Criminal investigations;
- The provision of off-site response forces and contingency planning;
- National security;
- ransportation of hazardous materials;
- Any other areas as appropriate?
- Are there procedures in place for the relevant State authority to communicate information on the threat to nuclear material and nuclear facilities and maintain it up to date?
- Does the assessment of the threat include information on adversary numbers, characteristics, capabilities and motivation?
- To whom are threat assessments passed?
- Are there procedures for advising those responsible for physical protection about the threat and significant changes to the threat?
- Which parts of the State organization arrange for external response to serious incidents concerning the physical protection?
- How do these response forces react to such incidents and how are they authorized?
- Are there contingency plans prepared for response to serious incidents concerning physical protection and how are these integrated with those for other emergency services?
- Are these plans exercised and modified as necessary?
- Which organization is responsible for the investigation of theft, sabotage or threats to sabotage or misuse nuclear materials and for the recovery of such materials?
- Are procedures in place for informing such organization of the loss/theft, sabotage or threats to sabotage or misuse of nuclear materials?
- Are there procedures to ensure that the physical protection competent authority and nuclear materials accounting and control authority activities are co-ordinated?
II-6. Facility and nuclear transport implementation of physical protection regulations
The concept of physical protection at any nuclear facility or during transportation of nuclear material takes into account:
- The State’s assessment of the threat;
- The type of the nuclear material categorized by the State in accordance with the Convention on Physical Protection (INFCIRC/274/Rev.1) and in the recommendations in INFCIRC/225, to be protected against unauthorized removal;
- Consideration of the potential for radioactive release in the event of sabotage; and
- Emergency procedures to handle a possible threat.
It is important that physical protection issues are considered early in the design of the nuclear facility and in any later modifications and before the transport of nuclear material. The physical protection system should aim to:
- Deter any internal or external threat to the nuclear material or nuclear facilities;
- Detect any attempt to breach the physical protection system;
- Delay any attempt of unauthorized removal of nuclear material or attempt sabotage; and
- Respond to threats.
To achieve these aims, physical protection systems require the integration of:
- Hardware including intrusion detection and access control systems and barriers such as fences, walls, doors and locks;
- Facility design to provide for defence in depth around the nuclear materials requiring protection;
- Facility design to protect against the effects of sabotage;
- Facility/licensee plans and procedures for the physical protection of nuclear materials during transport, both on and off the facility;
- Personnel responsible for managing the physical protection system at all levels; and
- Procedures to create and maintain conditions in which the physical protection system operates as intended.
The objectives of the physical protection system are to ensure that:
- Access to Category I and II nuclear materials and facilities is limited to those whose trustworthiness has been determined and that these individuals are kept to the minimum;
- Access to nuclear materials and facilities is positively authorized and these authorizations are regularly reviewed;
- In the event of a breach of the physical protection system being detected, a rapid and comprehensive response can be deployed to neutralize any threat or to recover any nuclear material; and
- During transportation of nuclear materials both on and off the facility, physical protection arrangements are "in depth" and emergency procedures are sufficient to handle effectively the possible threats.
The physical protection system should be designed to deter, detect, delay, and respond, if necessary, to the unauthorized removal of nuclear materials with progressively more severe physical protection systems protecting nuclear materials according to its categorization. However, at nuclear facilities where there is a potential for unacceptable releases of radioactive material, regardless of the categorization of the nuclear material contained therein, the physical protection system must be designed to adequately deter, detect and delay sabotage and provide an effective response.
II-6.2. Review points/specimen questions
- Has the applicant/licensee submitted a physical protection plan? Does it contain sufficientinformation about the nuclear material used, transported, or stored in the facility to be protected against unauthorized removal? Does it contain sufficient information about the areas of the facility determined to be protected against sabotage?
- Has the applicant defined the objectives of the physical protection measures which are specific to the category of nuclear material and to the way it is used, transported and stored at the facility? Has the applicant defined the objectives of physical protection measures specific to the protection against sabotage?
- Has the applicant/licensee defined the objectives of the physical protection measures which are specific to the category of nuclear material during transport to and from the facility/licensee?
- Has a safety analysis been performed in accordance with the national threat assessment and assumed adversary model to identify the facility areas that are to be protected?
- Are the protected areas, inner areas, and vital areas defined? Is the protected area under surveillance? Are the inner/protected areas protected by a barrier? Are the inner and vital areas under access control?
- Does the access control system provide for the identification and access authorization of all incoming personal, material and vehicles?
- Are there barriers to prevent the entry of unauthorized incoming vehicles?
- Is there a room inside a protected area where security personnel can monitor the condition and status of all physical protection equipment and which also has sufficient equipment to allow for communications with the safety and security personnel and to communicate with external response forces?
- Does the applicant/licensee have a head of security charged with the entire facility's physical protection system? Does the head of security have sufficient authority to report to the applicant/licensee representative and also, if appropriate, to the national regulatory authority directly? Who makes ultimate decisions regarding physical protection matters?
- Is there a sufficient guard service with personal who have appropriate levels of: education; training and experience; trustworthiness; physical ability; facility knowledge and authority?
- Does the guard force have sufficient equipment to carry out their tasks (e.g.,communications equipment, weapons)?
- Does the applicant/licensee have a program for training and exercising personnel in the implementation of physical protection measures? Are there instructions issued for this purpose and are they adequate?
- Is there a reporting system that supports the competent authority with sufficient information about relevant physical protection events and circumstances?
- Is physical protection equipment suitable for its intended use?
- Is there a maintenance and testing program for the physical protection equipment?
- Is there a program for periodic checks of the efficient functioning of the physical protection systems?
- Are there adequate on-site instructions and procedures in case of physical protection equipment failure?
- Is the information exchange between the safety and the security personnel sufficiently organized in planning and implementation of physical protection measures and in response to emergency situations?
- How are conflicts between the requirements or measures of physical protection or safety resolved?
- Do plans for the transport of nuclear materials include: protecting advance information on the movement; minimising the numbers of people who need to know the details; ensuring the trustworthiness of the individuals involved; minimising the time and number of transfers for the movement; providing load carriers with the necessary physical protection consistent with the category of nuclear material; avoiding the use of regular movement schedules and routes?
- Are measures consistent with national requirements taken to protect the confidentiality of information relating to transport operations, particularly for nuclear materials in Categories I and II?
- As appropriate for the categories of nuclear materials concerned, are there procedures for notification (and prior agreements in case of international transfer of nuclear material)of delivery by the sender and acceptance by the receiver of the time and place of the transfer of physical protection responsibility; are there procedures for the searching of transport vehicle before loading; are suitable communisations provided between the transport and the State or facility monitoring the movement; are escorts provided for the transport and are their instructions sufficient; are there contingency plans for response forces designated by the state to respond to an incident or emergency; and is the response force able to react to prevent the unauthorized removal of the nuclear material or to prevent sabotage?
- As appropriate for the categories of nuclear material concerned, do the procedures for international shipments include notification of the sending and receiving States’ authorities; adequate physical protection for the category of material concerned, including arrangements for response to incidents or emergencies; constant communications between the transport and the sending and receiving States’ competent authorities; the use of coded information to protect details of the movement; transfer of physical protection responsibility at agreed places and times?
II-7. Inspection and enforcement
The competent authority should establish a regime for inspection and enforcement that complements its licensing activities. It needs to ensure that each licensee complies with national legislation and maintains the nuclear installation(s), throughout all stages of its life, in conformity with the physical protection system approved by the competent authority
An inspection regime needs to be established to satisfy the competent authority that the licensee is fulfilling the conditions set out in the licence specifically related to physical protection measures. The competent authority will require correction of any non-compliance with the licence by exercising appropriate enforcement powers.
The competent authority should establish a structured system for evaluating and systematically following up all inspection findings and an enforcement system to ensure that all aspects of legislation, including the licence conditions, are fully complied with by each applicant/licensee, that this compliance is verifiable and that experience gained is fed back to the licensee.
The competent authority should ensure that the responsible persons in a licensee's organizations are qualified to discharge their physical protection functions.
The competent authority should ensure that the required self-assessments are performed by each licensee at times specified.
- Description of how the competent authority plans, carries out and documents its inspections;
- Description of the enforcement powers of the competent authority, how much is delegated and to what level, and how they are exercised in practice. Identify the relevant legislation that confers such powers; and
- Description of working relationship between any site/regional-based and headquarters- based competent authority staff.
II-7.3. Review points/specimen questions
- What are the responsibilities of the competent authority for inspection and enforcement of the physical protection measures? Specify the distribution of inspection responsibilities between the competent authority and the licensee. For example, does the competent authority only ensure that the licensee performs its own inspection programmes properly, or do both the competent authority and the licensee have separate inspection programmes?
- What types of inspection does the competent authority conduct to verify that the licensee has adequately demonstrated that installations comply with the physical protection regulations? Are there regulatory inspection programmes to which the inspector should adhere?
- Are special inspections to verify the physical protection measures (i.e. other than those in the routine programme) conducted as the result of a specific identified problem,concerns of the inspector, or a history of incidents or deficiencies?
- What kind of analysis is performed on regulatory inspection reports and by whom?
- Describe the basic arrangements and procedures for licensee reporting and classification of:
- abnormal occurrences and incidents concerning physical protection; and
- modifications to the facility.
The statement should describe how the regulatory inspection staff are made aware of the reports or requests, and should include any special requirements such as formal reporting and notification to third parties.
- What are the procedures for investigating abnormal occurrences or incidents?
- What legal powers of enforcement does the competent authority have to ensure compliance with the licence or other regulations?
- What methods of enforcement (e.g. warning letters, in order to curtail activities, suspension, withdrawal of licence, fines) are available to the competent authority? Describe the basic criteria for each type of enforcement action.
- What sanctions are included in the legislation in case of non-compliance with the physical protection legislation, including those acts included as punishable offences in the State penal legislation (e.g., unauthorized removal, theft or robbery, or threat to use nuclear material to cause death or injury to persons or damage to property)?