NSS No. 30-G Sustaining a Nuclear Security Regime

The legislative and regulatory framework and administrative systems and measures governing the nuclear security of nuclear material, other radioactive material, associated facilities and associated activities;

The institutions and organizations within the State responsible for ensuring the implementation of the legislative and regulatory framework and administrative systems of nuclear security;

Nuclear security systems and nuclear security measures for the prevention of, detection of and response to nuclear security events.” [1]

As Essential Element 12 of a nuclear security regime [1];

In paras 3.48–3.57 of IAEA Nuclear Security Series No. 13, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5) [3];

In paras 3.29–3.32 of IAEA Nuclear Security Series No. 14, Nuclear Security Recommendations on Radioactive Material and Associated Facilities [4];

In paras 3.16, 5.25 and 6.24 of IAEA Nuclear Security Series No. 15, Nuclear Security Recommendations on Nuclear and Other Radioactive Material out of Regulatory Control [5].

Building and maintaining a national commitment to nuclear security;

Establishing and regularly reviewing the legislative and regulatory framework;

Defining roles and responsibilities and ensuring accountability;

Updating the national threat assessment and using a risk informed approach;

Conducting effective planning and organization;

Developing human resources;

Fostering a robust nuclear security culture;

Maintaining oversight of and regularly evaluating the nuclear security regime.

Have in place a national nuclear security policy and strategy to ensure that the overall priority given to nuclear security and the priorities within nuclear security are appropriate and proportionate to the level and nature of the threat. The threat should be assessed periodically through a national threat assessment, whose results should be used to inform changes to the policy and strategy.

Systematically communicate nuclear security priorities to all relevant competent authorities and other stakeholders.

Provide sufficient human, financial and technical resources to support the nuclear security regime, including through regular budget allocations to competent authorities with responsibilities for nuclear security.

Actively participate in international activities that address the implementation of international legal instruments to which it is a State party or to which it has made a political commitment.

Enact appropriate legislation to provide the necessary legal powers to each competent authority;

Ensure that the roles and responsibilities of competent authorities, as established in relevant legislation and regulations, are clear — particularly where there may be a shared area of responsibility such as emergency response — and that there are mechanisms in place to address shared responsibilities;

Enact appropriate legislation to establish offences and penalties, including criminalization, for unauthorized acts involving or directed at nuclear material, other radioactive material, associated facilities or associated activities.

Establish and enforce regulations and associated administrative measures that support nuclear security, including requirements pertaining to transport security, information security, computer security and assessment of trustworthiness of staff, and enforceable measures for prevention, detection and response to nuclear security events.

Ensure that there is a comprehensive, predictable regulatory framework, including regular security inspections and enforcement actions for non-compliance;

Ensure that all actions taken in connection with the detection of and response to nuclear and other material out of regulatory control are authorized by law;

Regularly review, and if necessary update, the legislative and regulatory framework that supports the nuclear security regime, to ensure that it remains appropriate, effective, consistent and coherent.

Clearly define the scope of the nuclear security regime that is to be established, implemented, maintained and sustained in order to limit the potential for gaps and overlaps;

Clearly define and document assigned roles and responsibilities;

Hold competent authorities accountable for effectively meeting their nuclear security responsibilities by establishing, implementing, maintaining and sustaining an oversight mechanism;

Establish a coordinating mechanism or body and require cooperation among competent authorities;

Reassign nuclear security responsibilities if the existing assignment is inappropriate or if there is a need to address new issues.

Ensure that a national threat assessment is undertaken and revised on a regular basis, and disseminated to all appropriate competent authorities.

Ensure that the national threat assessment process is as inclusive as possible, with the active participation of all relevant competent authorities. This process ensures consideration of a wide range of viewpoints and sources of information, and maintains consensus about the credibility of the threat.

Ensure that the results of the national threat assessment are considered, as part of a risk informed approach, in the development of a design basis threat, where appropriate, and other regulatory requirements; in the design of nuclear security systems and measures; and in the development of other national instruments, such as the national detection strategy and the national response plan.

Apply the risk informed approach to develop strategies and plans and to tailor nuclear security systems and measures to address the most significant risks.

Ensure that appropriate resources are allocated to counter each threat on a level commensurate with the risk.

Ensure that each competent authority regularly prepares, uses and reviews a long term plan for meeting its nuclear security responsibilities;

Support research and development for nuclear security and encourage the utilization of appropriate technology;

Ensure that the various plans that relate to safety and security are interoperable and that appropriate attention is paid to the interfaces between safety and security in all key areas;

Make use of existing safety, security and law enforcement infrastructure in the planning process for the nuclear security regime;

Emphasize and promote the importance of integrated management systems, planning processes and allocation of adequate resources to support sustainable nuclear security;

Ensure that national level planning includes response plans that specifically address nuclear security events and that take into account interfaces with emergency response plans for nuclear and radiological emergencies [11]².

Foster professionalism in nuclear security by establishing qualification programmes, creating advanced degree programmes and supporting professional societies;

Establish nuclear security education and training programmes that develop the competences needed for the nuclear security regime;

Promote the importance of nuclear security education at the national level and to participate actively in international nuclear security education initiatives [12];

Ensure that appropriate management development and succession planning are undertaken within the relevant competent authorities to cultivate leaders who are committed to sustainable nuclear security.

Develop knowledge management programmes that include succession planning and knowledge transfer;

Identify and utilize national, regional and international programmes that most appropriately build, maintain and continuously improve the human resources necessary to sustain the nuclear security regime.

Establish or utilize existing indigenous training institutions, such as dedicated training departments within competent authorities;

Promote the importance of retaining senior officials with a high level of nuclear security expertise.

Promote nuclear security priorities at the national level;

Support participation in international initiatives that promote nuclear security culture.

Foster a high level of security awareness on the part of all staff, including management, with an appreciation of the threat and recognition of the need for nuclear security;

Establish clear expectations and accountability for nuclear security on the part of all staff, including management;

Systematically communicate nuclear security priorities to staff of all relevant competent authorities and other stakeholders;

Encourage teamwork and cooperation;

Develop effective leadership and management of nuclear security within their organizations, including positive role models;

Establish mechanisms to promote behaviour that supports nuclear security, such as raising concerns or making suggestions for improvement;

Provide training to staff in meeting their nuclear security responsibilities;

Develop tools and methodologies for assessing the nuclear security culture within their organizations.

Use peer reviews, such as IAEA advisory services, for benchmarking the national nuclear security regime against internationally recognized good practices;

Regularly assess the completeness and effectiveness of the nuclear security regime through oversight and evaluation, including integrated exercises and drills;

Ensure that competent authorities establish criteria for oversight and evaluation of nuclear security systems and measures.

Perform periodic inspections to verify compliance with applicable legislation, regulations and licence conditions. Inspections should result in enforcement actions and appropriate penalties for non-compliance.

Document and distribute lessons learned and good practices related to nuclear security (taking account of confidentiality requirements).

Managing and planning for sustainable operations;

Identifying and applying current threat information;

Developing and maintaining nuclear security competences;

Establishing and implementing an effective maintenance programme;

Applying configuration management;

Promoting a robust nuclear security culture;

Conducting regular compliance and performance evaluations.

Document relevant management decisions in appropriate plans.

Apply risk management to security related risks, as a comprehensive, robust and continuous process within a risk informed approach. Risk management includes:

• Identifying assets;

• Identifying risks;

• Planning and executing risk reduction actions;

• Assessing the effectiveness of actions and acceptability of residual risks;

• Repeating and improving the process.

Prepare and use a security plan, a transport security plan, contingency plans, an instrument deployment plan, a response plan and/or other plans appropriate to its operations. These plans should:

• Be based on consideration of appropriate threat information and application of the risk informed approach;

• Include appropriate agreements and identify relevant external organizations that may need to be contacted or informed in the case of a nuclear security event;

• Be regularly reviewed and revised, based on operational feedback and changes in requirements.

Make appropriate arrangements for measurement and assessment of security performance and continuous improvement.

Establish and document a systematic process for maintaining and acting on current threat information, including:

• Exchanging updated external and insider threat information with competent authorities;

• Establishing and maintaining relationships with competent authorities, including law enforcement bodies, to facilitate information exchange.

Review and mitigate potential insider threats through such means as a trustworthiness programme, information security measures and security training.

Adapt its nuclear security systems and measures, if necessary, to counter the current threat.

Implement compensatory measures, when necessary, in response to a specific, emerging or increased threat.

Have in place a mechanism for reporting updated threat or system effectiveness information to the responsible competent authorities.

Assign and document all nuclear security responsibilities, establish the number of staff needed, and define the qualifications and competences for each position;

Engage with and attract recruits from associated industries, military and intelligence services, law enforcement and other relevant professions, as well as trade associations, educational institutions and professional societies, through ongoing relationships with these organizations;

Determine the best means of providing training, through internal resources or using external training providers;

Provide for the continuous development and renewal of trained and qualified staff, by providing formal training programmes and mechanisms for career development, succession planning and retention of qualified staff.

Establish, implement, document and periodically review and update, as appropriate, a maintenance programme for security systems and equipment;

Perform preventive maintenance on a periodic basis;

Ensure that it has access to sufficient qualified maintenance staff, whether internally or externally;

Identify a single point of contact dedicated to maintenance of security systems and equipment;

Ensure that equipment is tested against design requirements before being returned to service;

Ensure that the maintenance programme provides for compensatory measures when equipment is out of service;

Ensure that sensitive equipment is not compromised during maintenance.

Apply configuration management to document the physical, procedural and training elements of its critical nuclear security systems;

Ensure that configuration management information is accurate, available in a timely manner and appropriately protected;

Ensure that the security implications of changes in the nuclear security systems subject to configuration management are reviewed prior to implementation and are documented appropriately;

Ensure that the security implications of changes in other systems that have an impact on nuclear security are reviewed prior to implementation and are documented appropriately.

Promote a high level of nuclear security awareness, including both an appreciation of the threat and recognition of the need for nuclear security, through regular communication with all staff;

Establish clear requirements, expectations and accountability regarding nuclear security;

Ensure that all staff are aware that security is everyone’s responsibility;

Establish mechanisms of positive reinforcement for behaviours and performance that support nuclear security, such as raising concerns or making suggestions for improvement;

Assess the strength of its nuclear security culture, through self-assessment and other means, and take corrective action, if necessary, as well as actions for continuous improvement;

Foster understanding by staff of the effects on and implications for nuclear security of their actions or omissions.

Implement formalized and documented compliance and performance evaluations.

Develop a plan to validate functional requirements and performance of the systems. The plan should provide a basis for the design and frequency of, and performance criteria for, the testing programme. These evaluations should verify that criteria for reliability, operability, readiness and performance are met.

Ensure that performance tests and exercises are conducted periodically, including tests and exercises with external response organizations.

Document results of evaluations, including corrective actions, and, where appropriate, report the results and findings to the competent authority.

INTERNATIONAL ATOMIC ENERGY AGENCY, Objective and Essential Elements of a State’s Nuclear Security Regime, IAEA Nuclear Security Series No. 20, IAEA, Vienna (2013).

INTERNATIONAL ATOMIC ENERGY AGENCY, Establishing the Nuclear Security Infrastructure for a Nuclear Power Programme, IAEA Nuclear Security Series No. 19, IAEA, Vienna (2013).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/ Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Radioactive Material and Associated Facilities, IAEA Nuclear Security Series No. 14, IAEA, Vienna (2011).

EUROPEAN POLICE OFFICE, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL CRIMINAL POLICE ORGANIZATION–INTERPOL, UNITED NATIONS INTERREGIONAL CRIME AND JUSTICE RESEARCH INSTITUTE, UNITED NATIONS OFFICE ON DRUGS AND CRIME, WORLD CUSTOMS ORGANIZATION, Nuclear Security Recommendations on Nuclear and Other Radioactive Material out of Regulatory Control, IAEA Nuclear Security Series No. 15, IAEA, Vienna (2011).

INTERNATIONAL ATOMIC ENERGY AGENCY, Development, Use and Maintenance of the Design Basis Threat, Implementing Guide, IAEA Nuclear Security Series No. 10, IAEA, Vienna (2009).

INTERNATIONAL ATOMIC ENERGY AGENCY, Risk Informed Approach for Nuclear Security Measures for Nuclear and other Radioactive Material out of Regulatory Control, IAEA Nuclear Security Series No. 24-G, IAEA, Vienna (2015).

Amendment to the Convention on the Physical Protection of Nuclear Material, INFCIRC/274/Rev.1/Mod.1, IAEA, Vienna (2016).

The Convention on the Physical Protection of Nuclear Material, INFCIRC/274/Rev.1, IAEA, Vienna (1980).

INTERNATIONAL ATOMIC ENERGY AGENCY, Security in the Transport of Radioactive Material, IAEA Nuclear Security Series No. 9, IAEA, Vienna (2008).

FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, PREPARATORY COMMISSION FOR THE COMPREHENSIVE NUCLEAR-TEST-BAN TREATY ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSR Part 7, IAEA, Vienna (2015).

INTERNATIONAL ATOMIC ENERGY AGENCY, Educational Programme in Nuclear Security, IAEA Nuclear Security Series No. 12, IAEA, Vienna (2010).

INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Culture, IAEA Nuclear Security Series No. 7, IAEA, Vienna (2008).