NSS No. 23-G Security of Nuclear Information

Establishing an effective framework for ensuring the confidentiality, integrity and availability of sensitive information (Section 3), including the necessary legislation and regulations;

Identifying information that may be considered as sensitive information (Section 4);

Considerations for the sharing and disclosure of sensitive information (Section 5);

Guidelines and methodologies for ensuring confidentiality, integrity and availability (Section 6).

Competent authorities, including regulatory bodies;

Management in facilities, companies and organizations involved in the use, storage or transport of nuclear material or other radioactive material;

Facility operators and their staff, particularly the security staff;

Contractors or other third parties working for the authorities, organizations or facility operators;

Any other entities that may have been given legitimate access to sensitive information.

The State;

Competent authorities;

Facility operators (including third parties, such as vendors);

A potential adversary (individuals and organized entities);

The media;

The public.

Security of information in physical forms (e.g. paper and electronic media);

Security of computer systems, sometimes referred to as computer security, information technology (IT) security or cybersecurity (additional IAEA guidance can be found in Computer Security at Nuclear Facilities [6]);

Security of information assets (e.g. information storage and processing equipment, communication systems and networks);

Security of information about facility employees and third parties (e.g. contractors and vendors) that could compromise the security of the above;

Security of intangible information (e.g. knowledge).

The responsibility of the State;

A legal and regulatory framework;

National guidance;

Security policies;

Classification schemes.

SECRET;

CONFIDENTIAL;

RESTRICTED.

No Further Distribution;

Distribution Controlled by Originator;

For Official Use;

Restricted Distribution;

Available for Public Use.

Details of physical protection systems and any other security measures in place for nuclear material, other radioactive material, associated facilities and activities, including information on guard and response forces;

Information relating to the quantity and form of nuclear material or other radioactive material in use or storage, including nuclear material accounting information;

Information relating to the quantity and form of nuclear material or other radioactive material in transport;

Details of computer systems, including communication systems, that process, handle, store or transmit information that is directly or indirectly important to safety and security;

Contingency and response plans for nuclear security events;

Personal information about employees, vendors and contractors;

Threat assessments and security alerting information;

Details of sensitive technology;

Details of vulnerabilities or weaknesses that relate to the above topics;

Historical information on any of the above topics. Some of the above information, such as personal information, may also be subject to specific security requirements under other national laws or company policies.

The sensitivity of certain types of sensitive information, based on the consequences of disclosure;

Which types of information can be disclosed, under which circumstances, to whom and by which particular methods;

Conditions on the disclosure of information;

Processes to review information for its potential sensitivity prior to public presentation, such as in conference presentations, web postings or technical specifications;

Which actions should be taken in any case of unauthorized disclosure of sensitive information, whether intentional or unintentional, or other breach of information security requirements.

Assuming overall responsibility for securing sensitive information and sensitive information assets;

Ensuring compliance with relevant laws and regulations;

Assigning organizational security responsibilities;

Providing effective security training and education;

Ensuring that an effective information security policy is established;

Providing adequate resources to implement an effective information security programme;

Ensuring development of the information security programme and associated plans and procedures;

Ensuring effective change management related to plans, procedures and policies;

Ensuring periodic audits, reviews and revisions of information security policy and procedures.

A definition of information security and a statement of its overall objectives, scope and importance.

A definition of roles and responsibilities, including the establishment of a focal point to direct and manage information security.

Compliance with information security requirements, including legal, regulatory and contractual requirements.

The establishment of a risk management plan to reduce risks to an acceptable level, defined by the State, by applying adequate controls based on a risk assessment approach. For a nuclear facility, the risk management plan should be approved by the competent authority or other authority designated by the State.

Regular monitoring and review of the arrangements in place to ensure that policy, standards and procedures remain relevant and effective.

Requirements for education and training to ensure that staff, contractors and other personnel have an appropriate awareness of policy, procedures and practice to the extent necessary for their duties, and that they fully understand their responsibilities (including their legal obligations).

The consequences (i.e. penalties or sanctions) for non-compliance with information security requirements or wilful negligence in securing sensitive information.

Reference documentation that supports the policy, for example more detailed procedures for specific systems or security rules to which users should adhere.

The information life cycle: definition of the processes to create, identify, classify, mark, handle, use, store, transmit, reclassify, reproduce and destroy sensitive information;

The security requirements for sensitive information, giving due consideration to the security objectives of confidentiality, integrity and availability of the information;

Restriction of access to sensitive information and sensitive information assets to those who need such access to perform their duties, who have the necessary authority and who have been subjected to a trustworthiness check commensurate with the classification level of the information;

The transmission of sensitive information in a manner that reduces any risk of compromise, unauthorized interception, modification or disruption to an acceptable level.

Administrative management to govern, maintain and develop information security (including third party services);

Personnel security, particularly in the phases of recruiting, and the beginning and end of employment;

Physical security of areas where sensitive information or sensitive information assets are used, handled or located;

Security of digital and manual information handling: workstation security, virus and malware protection, deletion and destruction of information, and manual processes;

Communication network security (telephones, email, the Internet and local area networks): policy, user authentication, equipment identification, segregation, connection and routing controls, and monitoring;

Equipment security: access control, logging of use, spare part management, backup of critical equipment, backup power arrangements, documentation and maintenance, cabling and media security;

Software security: access control, logging of user and super user activities, backup management, maintenance contracting, configuration and version management, use of registered, legal software, testing for vulnerabilities and testing for system behaviour under error conditions;

Security of use of information systems: user rights control, user recognition and verification, connecting to services, systems and equipment, password management, oversight of use, and the two person rule (i.e. two person control) for critical operations;

Classification and corresponding procedures for handling information;

Protection of privacy.

Defined structure of responsibility regarding authorization management;

Defined processes about the function who has the right to appoint whom and who has the right to access sensitive information and sensitive information assets;

Defined processes about how to verify, control and supervise the function of assigning access;

Defined processes to determine how long an authorization to access sensitive information and sensitive information assets should last;

Defined processes for revoking the authorization to access sensitive information and sensitive information assets;

Defined processes to maintain full traceability of the management of rights in all steps of the management chain for the authorization to access sensitive information and sensitive information assets.

Have information security processes and procedures that meet at least the requirements of the organization’s own security arrangements;

Have a focal point to direct and manage security at the contracting company;

Have in place a system to ensure that all staff with access to the sensitive information held by the third party have been subject to a trustworthiness check at an appropriate level;

Ensure that access to sensitive information and sensitive information assets is limited to only those who have the necessary need to know and the appropriate security clearance;

Transmit information in a manner compliant with national legislation, local policy and in such a way that information is not put at risk of compromise;

Ensure that the information is not shared with any unauthorized party or individual;

Ensure that all personnel have an appropriate awareness of security policy and practice and fully understand their responsibilities (including their legal obligations);

Have procedures to address information security events;

Ensure that security arrangements at the third party’s premises are regularly inspected by the competent authorities or contracting organizations in accordance with the provisions of the agreement, to ensure that they are in compliance with the security requirements of the agreement.

Look fully into the circumstances of the incident to establish the scope, scale and effect.

Assess the consequences of the incident and the degree of compromise that may have occurred.

Assess the need for further actions or wider enquiries, possibly to include other agencies.

Recommend corrective actions or take action to contain or minimize the consequences.

Report the outcome of the investigation, including:

The probable cause of the incident;

The assessed degree of compromise;

The likely effect(s) of the compromise;

Possible recommendations on improvements to the security programme in order to avoid a similar incident;

Recommended further actions warranted by the incident;

Lessons that need to be learned by the concerned parties.

INTERNATIONAL ATOMIC ENERGY AGENCY, Objective and Essential Elements of a State’s Nuclear Security Regime, IAEA Nuclear Security Series No. 20, IAEA, Vienna (2013).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/ Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Radioactive Material and Associated Facilities, IAEA Nuclear Security Series No. 14, IAEA, Vienna (2011).

EUROPEAN POLICE OFFICE, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL CRIMINAL POLICE ORGANIZATION–INTERPOL, UNITED NATIONS INTERREGIONAL CRIME AND JUSTICE RESEARCH INSTITUTE, UNITED NATIONS OFFICE ON DRUGS AND CRIME, WORLD CUSTOMS ORGANIZATION, Nuclear Security Recommendations on Nuclear and Other Radioactive Material out of Regulatory Control, IAEA Nuclear Security Series No. 15, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Preventive and Protective Measures against Insider Threats, IAEA Nuclear Security Series No. 8, IAEA, Vienna (2008).

INTERNATIONAL ATOMIC ENERGY AGENCY, Computer Security at Nuclear Facilities, IAEA Nuclear Security Series No. 17, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development, Use and Maintenance of the Design Basis Threat, IAEA Nuclear Security Series No. 10, IAEA, Vienna (2009).

INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Facilities and Activities, IAEA Safety Standards Series No. GS-R-3, IAEA, Vienna (2006).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Culture, IAEA Nuclear Security Series No. 7, IAEA, Vienna (2008).

To raise international tension;

To cause serious damage to relations between governments;

To threaten life directly, or seriously to prejudice public order, or individual security or liberty;

To cause serious damage to the operational effectiveness or security of national security forces or the continuing effectiveness of highly valuable security or intelligence operations;

To cause substantial material damage to national finances or economic and commercial interests;

To be of use to an individual or group planning a malicious act which could cause grave damage at a facility with, or during transport of, nuclear material or other radioactive material.

To damage diplomatic relations;

To prejudice individual security or liberty;

To cause damage to the operational effectiveness or security of national security forces or the effectiveness of valuable security or intelligence operations;

To work substantially against national finances or economic and commercial interests;

To substantially undermine the financial viability of major organizations;

To impede the investigation or to facilitate the commission of serious crimes;

To impede seriously the development or operation of major government policies;

To shut down or otherwise substantially disrupt significant national operations;

To be of use to an individual or group planning a malicious act which could cause serious damage at a facility with, or during transport of, nuclear material or other radioactive material.

To affect diplomatic relations adversely;

To cause substantial distress to individuals;

To make it more difficult to maintain the operational effectiveness or security of national security forces;

To cause financial loss or loss of earnings potential to, or to facilitate improper gain or advantage for, individuals or companies;

To prejudice the investigation of crime;

To facilitate the commission of crime;

To breach proper undertakings to maintain the confidence of information provided by third parties;

To impede the effective development or operation of government policies;

To breach statutory restrictions on disclosure of information;

To disadvantage government in commercial or policy negotiations with others;

To undermine the proper management of the public sector and its operations;

To be of use to an individual or group planning a malicious act which could cause significant damage at a facility with, or during transport of, nuclear material or other radioactive material.

Selecting a target for an act of theft, or sabotage of nuclear material or other radioactive material, equipment or facilities.

Planning or committing an act of theft or sabotage of nuclear material or other radioactive material, equipment or facilities:

Measuring the success of an act of theft or sabotage of nuclear material or other radioactive material, equipment or facilities:

Illegally producing a nuclear explosive device, radiological dispersal device or radiation exposure device:

Dispersing nuclear material or other radioactive material in the environment:

Design of security systems;

Building plans;

Methods and procedures for the transfer, accountability and handling of nuclear material or other radioactive material;

Security plans, procedures and capabilities.

Actual or hypothetical consequences of the sabotage of specific vital equipment or facilities.

Design information useful in developing a device;

Location of materials required to manufacture a device;

Location of a nuclear weapon.

Location, form and quantity of materials.

Awareness training increases awareness of threats and vulnerabilities and recognition of the need to protect data, information and the means of processing them (computer and information security awareness).

Topical training includes courses on specific aspects of security for all staff (classified material handling and information security incident procedures).

Professional training is typically detailed technical training for staff with particular responsibilities, for example for system administrators, software developers, network administrators, security guards, document classifiers and declassifiers, among others.

Specialized security training is focused and expert level training, usually for management level, in the areas of risk management, incident prevention and incident response, among other things.

Overview of the national security infrastructure.

Aspects of information security and why they are important to nuclear security.

The national classification system.

Security principles, for example ‘need to know’ and ‘need to hold’.

Current threats to security arising from deliberate actions by:

The threat from adversary organizations and from sabotage, taking account of the contemporary world threat from any extremist factions.

The risks and consequences of internal loss or leaks of sensitive information, perhaps through inadvertent behaviour or to cause embarrassment, together with deliberate betrayal for political motives or to assist terrorism.

Conduct or activities likely to help potential adversaries or increase the risk of compromise, including:

Information on topical security events or new types of approach being used by hostile agencies, which should be disseminated rapidly.

Emphasis on the need to report immediately all suspicious circumstances, perceived weaknesses in security procedures or vulnerable behaviour apparent in colleagues — the means of doing this in confidence should be widely briefed.

The effect of national laws and regulations and their relevance to individuals, for example, laws governing secrecy, anti-terrorism, security, data protection and freedom of information, and the sanctions and the punishment for transgression.

Explain the levels of security clearances; how trustworthiness checks are carried out; why they are necessary in the nuclear and radiological industry; and which levels of access relate to particular clearance and trustworthiness levels — in addition, how this relates to the threats to security mentioned above.

Denial of service (e.g. preventing an organization from having access to the information when needed, including actions such as theft) or destruction — a breach of availability.

Unauthorized modification of or interference with information — a breach of integrity.

Unauthorized disclosure — a breach of confidentiality.

Hostile intelligence services in respect of espionage and technology transfer;

Subversive organizations;

Other individuals and groups, such as information brokers and investigative journalists seeking to gain unauthorized access to sensitive information or nuclear sites and facilities;

Insiders.

Vulnerable behaviour such as casual attitudes to security and loose talk;

Unwitting behaviour that can attract the attention of hostile agencies and precautions needed in everyday activities, including, for example, social approaches, travel, correspondence and acquaintances.

Regular security newsletters published by the national security authorities. These can contain issues of topical interest and advice on a range of security matters.

Posters to remind individuals of the threats to security and of the principal security controls necessary to counter them. Their impact tends to be temporary, so posters should not only be prominently displayed but also frequently changed.

Stickers to remind employees of their personal responsibility for the maintenance of security when using specific items of equipment.

Security reminder notices in the startup (boot) phase of a computer system, which the user has to acknowledge reading before the computer will finish booting or logging in. (Systems can record such acknowledgements so that a user cannot deny having seen the notice.)

Security notices, bulletins and circulars drafted by security management to remind staff of certain security rules, to counter possible complacency, among other things.

Raising awareness of instances of breaches of security and the lessons to be learned from them.

Warning individuals of specific or topical threats to security and providing guidance to counter them.

Providing a channel of communication with individuals on security matters generally.

Regular periodic tests of individual security knowledge.

An organization’s intranet can also be a valuable tool in conveying or promoting the security message so long as the nature and sensitivity of the material remain within the accredited level of classification for the network.