Security Notifications, Reports, and Recordkeeping

10 C.F.R. Part ..., Subpart T
in effectEffective: 2024-07-01

10 C.F.R. § 73.1200 Notification of physical security events.

(a) 15-minute notifications—facilities. Each licensee subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.51, or § 73.55 of this part must notify the NRC Headquarters Operations Center, as soon as possible but within 15 minutes after— (1) The licensee's initiation of a security response in accordance with its safeguards contingency plan or protective strategy, based on an imminent or actual hostile action against a licensee's facility; or (2) The licensee's notification by law enforcement or government officials of a potential hostile action or act of sabotage anticipated within the next 12 hours against a licensee's facility. (3) Licensee notifications to the NRC must: (i) Identify the facility's name; and (ii) Briefly describe the nature of the hostile action or event, including: (A) The type of hostile action or event (e.g., armed assault, vehicle bomb, bomb threat, sabotage, etc.); and (B) The current status (i.e., imminent, in progress, or neutralized). (4) Notifications must be made according to paragraph (o) of this section, as applicable. (5) The licensee is not required to notify the NRC of security responses initiated as a result of threat or warning information communicated to the licensee from the NRC. (6) The licensee's request for immediate local law enforcement agency (LLEA) assistance or initiation of a contingency response may take precedence over the notification to the NRC. However, in such instances, the licensee must notify the NRC as soon as possible thereafter. (b) 15-minute notifications—shipments. Each licensee subject to the provisions of § 73.20, § 73.25, § 73.26, or § 73.37 or its designated movement control center must notify the NRC Headquarters Operations Center, as soon as possible but within 15 minutes after— (1) The licensee's initiation of a security response in accordance with its safeguards contingency plan or protective strategy, based on an imminent or actual hostile action against a shipment of Category I SSNM, spent nuclear fuel (SNF), or high-level radioactive waste (HLW); or (2) The licensee's notification by law enforcement or government officials of a potential hostile action or attempted act of sabotage anticipated within less than the next 12 hours against a shipment of Category I SSNM, SNF, or HLW. (3) Licensee notifications to the NRC must: (i) Identify the name of the facility making the shipment, the material being shipped, and the last known location of the shipment; and (ii) Briefly describe the nature of the threat or event, including: (A) Type of hostile threat or event (e.g., armed assault, vehicle bomb, theft of shipment, sabotage, etc.); and (B) Threat or event status (i.e., imminent, in progress, or neutralized). (4) Notifications must be made according to paragraph (o) of this section, as applicable. (5) The licensee is not required to notify the NRC of security responses initiated as a result of threat or warning information communicated to the licensee from the NRC. (6) The licensee's request for immediate LLEA assistance may take precedence over the notification to the NRC. However, in such instances, the licensee must notify the NRC as soon as possible thereafter. (c) One-hour notifications—facilities. (1) Each licensee subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67 must notify the NRC Headquarters Operations Center as soon as possible but no later than 1 hour after the time of discovery of the following significant facility security events involving— (i) Any event in which there is reason to believe that a person has committed or caused, or attempted to commit or cause, or has made a threat to commit or cause: (A) The theft or diversion of a Category I, II, or III quantity of SSNM or a Category II or III quantity of special nuclear material (SNM); (B) Significant physical damage to any nuclear power reactor, to a facility possessing a Category I or II quantity of SSNM, or to a facility storing or disposing of SNF and/or HLW; (C) The unauthorized operation, manipulation, or tampering with any nuclear power reactor's controls or with structures, systems, and components (SSCs) that results in the interruption of normal operation of the reactor; or (D) The unauthorized operation, manipulation, or tampering with any Category I SSNM facility's SSCs that results in an accidental criticality. (ii)(A) For licensees required to have a vehicle barrier system protecting their facility, the introduction beyond the vehicle barrier of a quantity of unauthorized explosives that meets or exceeds the relevant facility's adversary characteristics. (B) This provision is applicable to facilities where the vehicle barrier system protecting the facility is located at the Protected Area boundary. (iii) The licensee's notification by law enforcement or government officials of a potential hostile action or act of sabotage anticipated within greater than 12 hours against a licensee's facility. (2) Notifications must be made according to paragraph (o) of this section, as applicable. (3) Notifications made under paragraph (a) of this section are not required to be repeated under this paragraph. (4) As an exemption, licensees subject to § 73.50, § 73.60, or § 73.67 are not required to make notifications for events listed under paragraph (c)(1)(iii) of this section. (d) One-hour notifications—shipments. (1) Each licensee subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, § 73.37, or § 73.67 or its designated movement control center must notify the NRC Headquarters Operations Center as soon as possible but no later than 1 hour after the time of discovery of the following significant transportation security events involving— (i) Any event in which there is reason to believe that a person has committed or caused, or attempted to commit or cause, or has made a threat to commit or cause: (A) The theft or diversion of the Category I, II, or III quantity of SSNM; a Category II or III quantity of SNM; SNF; or HLW being transported; (B) Significant physical damage to any vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; or (C) Significant physical damage to the Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW being transported. (ii) The discovery of the loss of a shipment of Category I SSNM. (iii) The recovery of, or accounting for, a lost shipment of Category I SSNM. (iv) The licensee's notification by law enforcement or government officials of a potential hostile action or attempted act of sabotage anticipated within greater than the next 12 hours against a shipment of Category I quantities of SSNM, SNF, or HLW. (2) Notifications must be made according to paragraph (o) of this section, as applicable. (3) Notifications made under paragraph (b) of this section are not required to be repeated under this paragraph. (e) Four-hour notifications—facilities. (1) Each licensee subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67 of this part must notify the NRC Headquarters Operations Center within 4 hours after time of discovery of the following facility security events involving— (i) The actual access of an unauthorized person into a facility's protected area (PA), vital area (VA), material access area (MAA), or controlled access area (CAA); (ii) The attempted access of an unauthorized person into a PA, VA, MAA, or CAA; (iii) The actual introduction of contraband into a PA, VA, or MAA; (iv) The attempted introduction of contraband into a PA, VA, or MAA. (v)(A) The discovery that a weapon that is authorized by the licensee's security plan is lost or uncontrolled within a PA, VA, or MAA; (B) Uncontrolled authorized weapons are defined as weapons that are authorized by the licensee's security plan and are not in the possession of authorized personnel or are not in an authorized weapons storage location; (vi) The unauthorized operation, manipulation, or tampering with any nuclear reactor or Category I SSNM facility's controls or SSCs that could prevent the implementation of the licensee's protective strategy for protecting any target set; (vii) The identification or discovery of a previously unrecognized or unidentified vulnerability that could prevent the implementation of the licensee's protective strategy for protecting any target set; or (viii)(A) For licensees required to have a vehicle barrier system protecting their facility, the identification or discovery at or beyond the vehicle barrier of unauthorized explosives. (B) This provision is applicable to facilities where the vehicle barrier system protecting the facility is located at a distance from the Protected Area boundary greater than that assumed in the facility's blast analysis. (2) An event related to the licensee's implementation of their security program for which a notification was made to local, State, or Federal law enforcement officials provided that the event does not otherwise require a notification under paragraphs (a) through (h) of this section. (3)(i) An event involving a law enforcement response to the facility that could reasonably be expected to result in public or media inquiries and that does not otherwise require a notification under paragraphs (a) through (h) of this section, or in other NRC regulations such as § 50.72(b)(2)(xi) of this chapter. (ii) As an exemption, licensees need not report law enforcement responses to minor incidents, such as traffic accidents. (4) For licensees subject to the provisions of § 73.55 of this part, an event involving the licensee's suspension of security measures. (5) Notifications must be made according to paragraph (o) of this section, as applicable. (6) Notifications made under paragraphs (a) and (c) of this section are not required to be repeated under this paragraph. (f) Four-hour notifications—shipments. (1) Each licensee subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, § 73.37, or § 73.67 or its designated movement control center must notify the NRC Headquarters Operations Center within 4 hours after time of discovery of the following transportation security events involving— (i) The actual access of an unauthorized person into a transport vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; (ii) The attempted access of an unauthorized person into a transport vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; (iii) The actual access of an unauthorized person into the Category I or II quantity of SSNM, Category II quantity of SNM, SNF, or HLW being transported; (iv) The attempted access of an unauthorized person into the Category I or II quantity of SSNM, Category II quantity of SNM, SNF, or HLW being transported; (v) The actual introduction of contraband into a transport vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; (vi) The attempted introduction of contraband into a transport vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; (vii) The actual introduction of contraband into the Category I or II quantity of SSNM, Category II quantity of SNM, SNF, or HLW being transported; (viii) The attempted introduction of contraband into the Category I or II quantity of SSNM, Category II quantity of SNM, SNF, or HLW being transported; (ix) The discovery of the loss of a shipment of Category II or III quantities of SSNM, Category II or III quantities of SNM, SNF, or HLW; or (x) The recovery of or accounting for a lost shipment of Category II or III quantities of SSNM, Category II or III quantities of SNM, SNF, or HLW. (2) An event related to the licensee's implementation of their security program for which a notification was made to local, State, or Federal law enforcement officials, provided that the event does not otherwise require a notification under paragraphs (a) through (h) of this section. (3) Notifications must be made according to paragraph (o) of this section, as applicable. (4) Notifications made under paragraphs (b) and (d) of this section are not required to be repeated under this paragraph. (g) Eight-hour notifications—facilities. (1) Each licensee subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67 must notify the NRC Headquarters Operations Center within 8 hours after time of discovery of the following facility security program failures involving— (i) Any failure, degradation, or vulnerability in a security or safeguards system, for which compensatory measures have not been employed within the required timeframe, that could allow unauthorized or undetected access of— (A) Unauthorized personnel into a PA, VA, MAA, or CAA; or (B) Contraband into a PA, VA, or MAA; (ii) The unauthorized operation, manipulation, or tampering with any nuclear power reactor's controls or with SSCs that does not result in the interruption of normal operation of the reactor; or (iii) The unauthorized operation, manipulation, or tampering with any Category I SSNM facility's SSCs that does not result in the interruption of normal operation of the facility or an accidental criticality. (2) Notifications must be made according to paragraph (o) of this section, as applicable. (3) Notifications made under paragraphs (a), (c), and (e) of this section are not required to be repeated under this paragraph. (h) Eight-hour notifications—shipments. (1) Each licensee subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, § 73.37, or § 73.67 or its designated movement control center must notify the NRC Headquarters Operations Center within 8 hours after time of discovery of the following transportation security program failures involving any failure, degradation, or vulnerability in a security or safeguards system, for which compensatory measures have not been employed within the required timeframe, that could allow unauthorized or undetected access of— (i) Personnel or contraband into a transport vehicle transporting a Category I or II quantity of SSNM, a Category II quantity of SNM, SNF, or HLW; or (ii) Personnel or contraband into the Category I or II quantity of SSNM, Category II quantity of SNM, SNF, or HLW being transported; (2) Notifications must be made according to paragraph (o) of this section, as applicable. (3) Notifications made under paragraphs (b), (d), and (f) of this section are not required to be repeated under this paragraph. (i) through (l) [Reserved] (m) Enhanced weapons notifications—stolen or lost. (1) Each licensee possessing enhanced weapons in accordance with § 73.15 must— (i) Immediately notify the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) upon discovery of any stolen or lost enhanced weapons (see 27 CFR 479.141). (ii) Notify the NRC Headquarters Operations Center as soon as possible, but not later than 1 hour, after notification to the ATF of the discovery of any stolen or lost enhanced weapons possessed by the licensee. (iii) Notify the appropriate local law enforcement agency (LLEA) officials as soon as possible, but not later than 48 hours, after the discovery of stolen or lost enhanced weapons. This notification must be made by telephone or in person to the appropriate LLEA officials. Licensees must include appropriate point of contact information in their security event notification procedures. (2) Notifications to the NRC must be made according to paragraph (o) of this section, as applicable. (n) Enhanced weapons—adverse ATF findings. (1) Each licensee possessing enhanced weapons in accordance with § 73.15 must— (i) Notify the NRC Headquarters Operations Center as soon as possible, but not later than 24 hours, after receipt of an adverse inspection finding, enforcement finding, or other adverse notice from the ATF regarding the licensee's possession, receipt, transfer, transportation, or storage of enhanced weapons; and (ii) Notify the NRC Headquarters Operations Center as soon as possible, but not later than 24 hours after receipt of an adverse inspection finding, enforcement finding or other adverse notice from the ATF regarding any ATF issued Federal firearms license to the NRC licensee. (2) Notifications must be made according to paragraph (o) of this section, as applicable. (o) Notification process. (1) Each licensee must make the telephonic notifications to the NRC required by paragraphs (a) through (n) of this section to the NRC Headquarters Operations Center via any available telephone system. Commercial telephone numbers for the NRC Headquarters Operations Center are specified in Table 1 of appendix A of this part. (2) Licensees must make required telephonic notifications via any method that will ensure that a report is received by the NRC Headquarters Operations Center or other specified government officials within the timeliness requirements of paragraphs (a) through (n) of this section, as applicable. (3) Notifications required by this section that contain Safeguards Information may be made to the NRC Headquarters Operations Center without using secure communications systems under the exception of § 73.22(f)(3) for the communication of emergency or extraordinary conditions. (4)(i) Notifications required by this section that contain classified national security information and/or classified restricted data must be made to the NRC Headquarters Operations Center using secure communications systems appropriate to the classification level of the message. Licensees making classified telephonic notifications must contact the NRC Headquarters Operations Center at the commercial numbers specified in Table 1 of appendix A to this part and request a transfer to a secure telephone, as specified in paragraph III of appendix A to this part. (ii) If the licensee's secure communications capability is unavailable (e.g., due to the nature of the security event), the licensee must provide to the NRC the information required by this section, without revealing or discussing any classified information, in order to meet the timeliness requirements of this section. The licensee must also indicate to the NRC that its secure communications capability is unavailable. (iii) Licensees using a non-secure communications capability may be directed by the NRC emergency response management, in accordance with 32 CFR 2001.52(a), to provide classified national security information to the NRC over the non-secure system, due to the significance of the ongoing security event. In such circumstances, the licensee must document this direction and any information provided to the NRC over a non-secure communications capability in the follow-up written report required in accordance with § 73.1205. (5) For events reported under paragraph (a) of this section, the NRC may request that the licensee establish and maintain an open and continuous communications channel with the NRC Headquarters Operations Center as soon as possible. (i) Licensees must establish the requested continuous communications channel once the licensee has completed other required notifications under this section, § 50.72 of this chapter, appendix E to part 50 of this chapter, § 70.50 of this chapter; or § 72.75 of this chapter; as appropriate. (ii) Licensees must complete any immediate actions required to stabilize the plant, to place the plant in a safe condition, to implement defensive measures, or to request assistance from the LLEA. (iii) When established, the continuous communications channel must be staffed by a knowledgeable individual in the licensee's security, operations, or emergency response organizations from a location deemed appropriate by the licensee. (iv) The continuous communications channel may be established via any available telephone system. (6) For events reported under paragraph (b) of this section, the NRC may request that the licensee or its movement control center establish and maintain an open and continuous communications channel with the NRC Headquarters Operations Center as soon as possible. (i) Licensees must establish the requested continuous communications channel once the licensee or the movement control center has completed other required notifications under this section, § 50.72 of this chapter, appendix E to part 50 of this chapter, or § 70.50 of this chapter; § 72.75 of this chapter; or requested assistance from the LLEA, as appropriate. (ii) When established, the continuous communications channel must be staffed by a knowledgeable individual in the licensee's security, operations, or emergency response organizations or the movement control center monitoring the shipment. (iii) The continuous communications channel may be established via any available telephone system. (7)(i) For events reported under paragraphs (c), (e), (g), and (m) of this section, the NRC may request that the licensee establish and maintain an open and continuous communications channel with the NRC Headquarters Operations Center. (ii) When established, the continuous communications channel must be staffed by a knowledgeable individual in the licensee's security, operations, or emergency response organizations from a location deemed appropriate by the licensee. (iii) The continuous communications channel may be established via any available telephone system. (8)(i) For events reported under paragraphs (d), (f), and (h) of this section, the NRC may request that the licensee or the movement control center establish and maintain an open and continuous communications channel with the NRC Headquarters Operations Center. (ii) When established, the continuous communications channel must be staffed by a knowledgeable individual in the movement control center monitoring the shipment. (iii) The continuous communications channel may be established via any available telephone system. (p) Significant supplemental information. Licensees identifying significant supplemental information for events reported under paragraphs (a) through (h), (m), and (n) of this section, subsequent to the initial telephonic notification to the NRC Headquarters Operations Center, must notify the NRC Headquarters Operations Center of such supplemental information under paragraph (o) of this section. (q) Retraction of previous security event reports. (1) Licensees desiring to retract a previous physical security event notification made under paragraphs (a) through (h), (m), and (n) of this section, which have been determined to be invalid, not reportable in accordance with the requirements of paragraphs (a) through (h), (m), and (n) of this section, or recharacterized as recordable under § 73.1210 of this part (instead of reportable under § 73.1200), must telephonically notify the NRC Headquarters Operations Center in accordance with paragraph (o) of this section and indicate the report that is being retracted and the basis for the retraction. (2) Invalid, not reportable, or recharacterized events include, but are not limited to, events for which the licensee subsequently receives new information regarding the event or relevant information from an external entity (e.g., the initial information on a reportable event is subsequently determined to be incorrect or a law enforcement determination is made on the absence of a malevolent intent). (r) Declaration of emergencies. Licensees notifying the NRC of the declaration of an emergency class must do so in accordance with §§ 50.72, 63.73, 70.50, and 72.75 of this chapter, as applicable. (s) Elimination of duplication. Licensees with notification obligations under paragraphs (a) through (h), (m), and (n) of this section and §§ 50.72, 63.73, 70.50, and 72.75 of this chapter may notify the NRC of events in a single communication. This communication must identify each regulation under which the licensee is reporting. (t) Classified information. Licensee notifications regarding security events associated with the deliberate disclosure, theft, loss, compromise, or possible compromise of classified documents, information, or material must comply with the requirements found in § 95.57 of this chapter.

10 C.F.R. § 73.1205 Written follow-up reports of physical security events.

(a) General requirements. (1) Licensees making a telephonic notification under § 73.1200 of this part must also submit a written follow-up report to the NRC within 60 days of such notifications, in accordance with § 73.4. (2) As an exemption, licensees are not required to submit a written follow-up report subsequent to a telephonic notification made— (i) Under the provisions of § 73.1200(e) and (f) regarding interactions with a Federal, State, or local law-enforcement agency; (ii) Under the provisions of § 73.1200(m) regarding lost or stolen enhanced weapons; or (iii) Under the provisions of § 73.1200(n) regarding adverse findings from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) for enhanced weapons possessed by the licensee. (3)(i) Licensees are not required to submit a written follow-up report if the licensee subsequently retracts a telephonic notification made under § 73.1200 as invalid, not reportable under § 73.1200, or recharacterized as recordable under § 73.1210 (instead of reportable under § 73.1200), and has not yet submitted a written follow-up report under this section. (ii) If the licensee subsequently retracts a telephonic notification made under § 73.1200 after it has submitted a written follow-up report under this section, then the licensee must submit a revised written follow-up report documenting the retraction. (b) Submission criteria. (1) Each licensee must submit to the NRC written follow-up reports that contain sufficient information for NRC analysis and evaluation and are of a quality that will permit legible reproduction and processing. (2)(i) Licensees subject to § 50.73 of this chapter must prepare the written follow-up report on NRC Form 366. (ii) Licensees not subject to § 50.73 of this chapter must prepare the written follow-up report in a letter format. (3)(i) If significant supplemental information becomes available after the submission of the initial written follow-up report, then the licensee must submit a revised report with the revisions indicated. (ii) The revised written follow-up report must replace the previous written report in its entirety. The update must be complete and not be limited to only supplementary or revised information. (iii) Errors discovered in a written follow-up report must be corrected in a revised report with the revisions indicated. (c) Contents. A written follow-up report must contain: (1) A brief abstract describing the major occurrences during the event or condition, including all component or system failures that contributed to the event or condition, and significant corrective actions taken or planned to prevent recurrence. (2) A clear, specific, narrative description of what occurred so that a knowledgeable reader conversant with general security program requirements, but not familiar with the security requirements for the specific facility or activity, can understand the complete event. (3) The narrative description must include, as a minimum, the following information, as applicable— (i) The date and time the event or condition was discovered; (ii) The date and time the event or condition occurred; (iii) The affected structures, systems, components, equipment, or procedures; (iv) The environmental conditions at the time of the event or occurrence, if relevant; (v) The root cause of the event or condition; (vi) Whether any human performance errors were the cause or were a contributing factor to the event or condition, including: personnel errors, inadequate procedures, or inadequate training; (vii) Whether previous events or conditions are relevant to the current event or condition and whether corrective actions to prevent recurrence were ineffective or insufficient; (viii) Whether this event or condition is a recurring failure of a structure, system, component, or procedure important to security; (ix) What compensatory measures, if any, were implemented in response to the event or condition; (x) What corrective actions, if any, were taken in response to the event or condition; and (xi) When corrective actions, if any, were taken or will be completed. (d) Transmission criteria. (1) In addition to the addressees specified in § 73.4, the licensee must also provide one copy of the written follow-up report addressed to the Director, Office of Nuclear Security and Incident Response (NSIR). (2) For copies of a classified written follow-up report, the licensee must transmit them to the NRC via either the NRC Headquarters classified mailing address specified in Table 2 of appendix A to this part or via the NRC's secure email address specified in Table 1 of appendix A to this part. (3) Each written follow-up report containing classified information must be created, stored, marked, labeled, handled, transmitted to the NRC, and destroyed in accordance with the requirements of part 95 of this chapter. (4) Each written follow-up report containing Safeguards Information must be created, stored, marked, labeled, handled, transmitted to the NRC, and destroyed in accordance with the requirements of §§ 73.21 and 73.22. (e) Records retention. Licensees must maintain a copy of a written follow-up report as a record for a period of 3 years from the date of the report or until termination of the license, whichever is later.

10 C.F.R. § 73.1210 Recordkeeping of physical security events.

(a) Objective and purpose. (1) Licensees with facilities or shipment activities subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, § 73.37, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67, must record the physical security events and conditions adverse to security that are specified in paragraphs (c) through (f) of this section. (2) These records facilitate the licensee's monitoring of the effectiveness of its physical security program. These records also facilitate the licensee's effective tracking, trending, and performance monitoring of these security events and conditions adverse to security; and the subsequent identification and implementation of corrective actions to prevent recurrence. (3) These physical security events and conditions adverse to security include, but are not limited to, human performance security errors; failure to comply with security procedures; insufficient or inadequate security procedures; security equipment failures and malfunctions; security structures, systems, and components design deficiencies; and inadequate or insufficient security structures, systems, and components. This includes events or conditions where the licensee has implemented compensatory measures within the required timeframe specified in its physical security plan. (b) General requirements. (1) Licensees must record within 24 hours of the time of discovery the physical security events and conditions adverse to security specified in paragraphs (c) through (f) of this section. (2) Licensees must retain these records for a period up to 3 years after the last entry is recorded, or until their license is terminated, whichever is later. (3)(i) Licensees must record these physical security events and conditions adverse to security in either a stand-alone safeguards event log or as part of the licensee's corrective action program, as specified under the applicable quality assurance program provisions of parts 50, 52, 60, 63, 70, and 72 of this chapter, or both. (ii) Licensees choosing to use their corrective action program to record these physical security events and conditions adverse to security must ensure that the records contain sufficient information to permit the effective tracking, trending, and performance monitoring of these events and conditions and the implementation of corrective actions. (iii) Licensees must ensure that Safeguards Information or classified security information associated with these records is created, stored, and handled in accordance with the provisions of § 73.21, or of part 95 of this chapter, as applicable. (iv) Licensees choosing to use their corrective action program for these records may also choose to bifurcate the information in such records systems so as to maximize the use and advantages of their corrective action programs' tracking, trending, and performance monitoring capabilities while simultaneously compartmenting sensitive security information and security vulnerabilities (i.e., by controlling access and limiting need to know to necessary personnel), in order to ensure information protection requirements are effectively implemented. (4) These records must include, but are not limited to, information on the following data elements, as applicable— (i) The date and time the event or condition was discovered; (ii) The date and time the event or condition occurred; (iii) The affected structures, systems, components, equipment, or procedures; (iv) A description of the event or condition; (v) The environmental conditions at the time of the event or occurrence, if relevant; (vi) The root cause of the event or condition; (vii) Whether any human performance errors were the cause or were a contributing factor of the event or condition, including: personnel errors, inadequate procedures, or inadequate training; (viii) Whether previous events or conditions are relevant to the current event or condition and whether corrective actions were ineffective or insufficient; (ix) Whether this event or condition is a recurring failure of a structure, system, component, or procedure; (x) What compensatory measures, if any, were implemented in response to the event or condition; (xi) What corrective actions, if any, were taken in response to the event or condition; and (xii) When corrective actions, if any, were taken or will be completed. (5) Physical security events and conditions adverse to security for which notifications were made to the NRC under § 73.1200 are not required to be recorded under this section. (6) Suspicious activities that are reported under § 73.1215 are not required to be recorded under this section. (7) Enhanced weapons events that are reported under § 73.1200 are not required to be recorded under this section. (c) Compensated security events. The requirements of this section apply to any failure, degradation, or discovered vulnerability in a security or safeguards system for which compensatory measures were established within the required timeframe and for which the following could have resulted in— (1) Undetected access of unauthorized explosives beyond a required vehicle barrier; (2) Unauthorized personnel gaining access into a protected area (PA), vital area (VA), material access area (MAA), or controlled access area (CAA); (3) Undetected access of contraband into a PA, VA, or MAA; (4) Unauthorized personnel accessing a vehicle transporting a Category I or II quantity of strategic special nuclear material (SSNM), spent nuclear fuel (SNF), or high-level radioactive waste (HLW); (5) Unauthorized personnel accessing a Category I or II quantity of SSNM, SNF, or HLW being transported; (6) Undetected introduction of contraband into a vehicle transporting a Category I or II quantity of SSNM, SNF, or HLW; or (7) Undetected introduction of contraband into the Category I or II quantity of SSNM, SNF, or HLW being transported. (d) Ammunition events. (1) For licensees with armed security personnel, the discovery that greater than a small quantity of live ammunition authorized by the licensee's security plan: (i) Has been lost inside a PA, VA, or MAA; or (ii) Has been found uncontrolled inside a PA, VA, or MAA. (2)(i) The discovery that greater than a small quantity of unauthorized live ammunition is inside a PA, VA, or MAA. (ii) A small quantity of live ammunition means five rounds or fewer of ammunition. (iii) Uncontrolled authorized ammunition means ammunition authorized by the licensee's security plans that is not in the possession of authorized personnel or is not in an authorized ammunition storage location. (iv) Unauthorized ammunition means ammunition that is not authorized by the licensee's security plans. (3) As exemptions, licensees are not required to record: (i) Ammunition that is in the possession of Federal, State, or local law-enforcement personnel performing official duties inside a PA, VA, or MAA is considered controlled and authorized; or (ii) Blank ammunition used for training purposes by the licensee. (e) [Reserved] (f) Decreases in the effectiveness of the physical security program. The requirements of this section apply to any other threatened, attempted, or committed act not previously defined in this section that has resulted in or has the potential for decreasing the effectiveness of the licensee's physical security program below that committed to in a licensee's NRC-approved physical security plan. (g) Classified Information. Licensee recordkeeping requirements regarding any security events or conditions adverse to security involving any infractions, losses, compromises, or possible compromise of classified information or classified documents are found in § 95.57 of this chapter. (h) Recordkeeping—exemptions. Licensees subject to § 73.67 who possess or transport SSNM or special nuclear material (SNM) in the following categories are exempt from the provisions of this section: (1) Category III quantity of SSNM; (2) Category II quantity of SNM; or (3) Category III quantity of SNM.

10 C.F.R. § 73.1215 Suspicious activity reports.

(a) Purpose. This section sets forth the reporting criteria and process for licensees to use in reporting suspicious activities. Licensees are required to report suspicious activities to the local law enforcement agency (LLEA), the Federal Bureau of Investigation (FBI) local field office, the NRC, and the Federal Aviation Administration (FAA) local control tower if aircraft are a part of the suspicious activity. (b) Objective. (1) A licensee's timely submission of suspicious activity reports (SARs) to Federal and local law enforcement agencies is an important part of the U.S. government's efforts to disrupt or dissuade malevolent acts against the nation's critical infrastructure. Despite the increasingly fluid and unpredictable nature of the threat environment, some elements of terrorist tactics, techniques, and procedures remain constant. For example, attack planning and preparation generally proceed through several predictable stages, including intelligence gathering and preattack surveillance or reconnaissance. These preattack stages, in particular, offer law enforcement and security personnel a significant opportunity to identify and disrupt or dissuade acts of terrorism before they occur. However, to use this information most effectively, timely reporting of suspicious activities by licensees to both Federal and local law enforcement is of vital importance. (2) Licensee's timely submission of SARs to the NRC supports one of the agency's primary mission essential functions of threat assessment for licensed facilities, materials, and shipping activities. (c) General requirements. (1)(i) Licensees subject to paragraphs (d), (e), and (f) of this section must report suspicious activities that are applicable to their facility, material, or shipping activity. (ii) If a suspicious activity requires a physical security event notification pursuant to § 73.1200, then the licensee is not required to also report the occurrence as a suspicious activity pursuant to this section. (iii) If a suspicious activity report results in a LLEA response the licensee must notify the NRC in accordance with the requirements of § 73.1200. (2)(i) Licensees must promptly assess whether an activity is suspicious. Licensees may review additional information as part of an assessment process, including interactions with their LLEA. However, such assessments and any subsequent reporting must be completed as soon as possible, but within 4 hours of the time of discovery. The licensee must base its assessment upon its best available information on the activity, which may include its knowledge of its locale and the local population. (ii) The licensee's assessment of a potential suspicious activity, and any discussion of this activity with its LLEA, does not constitute a conclusion, in and of itself, that the activity is suspicious. (iii) Licensees are not required to report activities that, based on their assessment, appear to be innocent or innocuous. (3) For a suspicious activity specified under paragraph (d) of this section, the licensee must make the following reports: (i) First, to their LLEA; (ii) Second, to their applicable FBI local field office; (iii) Third, to the NRC Headquarters Operations Center; and (iv) Lastly, to the local FAA control tower if the suspicious activity involves aircraft overflights in proximity to the licensee's facility. (4) For a suspicious activity specified under paragraphs (e) and (f) of this section, the licensee or its designated movement control center must make the following reports, in the order indicated: (i) First, to the applicable LLEA; (ii) Second, to the applicable FBI local field office; and (iii) Lastly, to the NRC Headquarters Operations Center. (iv) For licensees making such reports related to shipping activities, the licensee responsible for the security of the shipment must contact the applicable FBI local field office. (v) For a movement control center making such reports related to shipping activities, the applicable FBI local field office is as requested by the FBI. As such, the FBI may direct the use of the FBI local field office applicable to the movement control center itself or to the FBI local field office applicable to the licensee responsible for the security of the shipment. (5)(i) Licensees subject to paragraphs (d) and (f) of this section must establish a point of contact with their local FBI field office. (ii) Licensees subject to paragraph (d) of this section must establish a point of contact with their local FAA control tower. (6)(i) For licensees subject to paragraph (e) of this section who are responsible for the security of the shipment(s), the licensee must establish a point of contact with their local FBI field office. (ii) For licensees subject to paragraph (e) of this section who are employing the services of a movement control center, the movement control center must establish a point of contact with its local FBI field office. (7) Licensees and movement control centers reporting suspicious activities to the NRC must notify the NRC Headquarters Operations Center via the telephone number specified in Table 1 of appendix A of this part. (8)(i) Licensees and movement control centers reporting suspicious activities must document the LLEA and FBI points of contact in written security communication procedures or route approvals, as applicable. (ii) Licensees reporting suspicious aircraft overflight activities must document the FAA point of contact in written communication procedures. (d) Suspicious activities—facilities and materials. (1) For licensees subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67, the licensees must report activities they assess are suspicious. Examples include, but are not limited to, the following: (i) Challenges to the licensee's security systems and procedures; (ii) Elicitation of non-public information from knowledgeable licensee or contractor personnel regarding the licensee's security or emergency response programs; (iii) Observed surveillance or reconnaissance activity from within posted or restricted areas (i.e., non-public areas), including surface activity, underwater activity, manned aerial activity, and unmanned aerial activity; (iv) Observed surveillance activity from public spaces outside of the licensee's control; or (v) Unauthorized aircraft activities in close proximity to the facility (i.e., above or near), involving either manned or unmanned aircraft, operating in a manner potentially indicative of surveillance or reconnaissance activity. (2) As an exemption, this paragraph does not apply to: (i) Licensees who are subject to the provisions of § 73.67, and who are also engaged in the enrichment of special nuclear material using Restricted Data (RD) information, technology, or materials. (ii) Licensees who are subject to the provisions of § 73.67 of this part, and who are also engaged in the fabrication of new fuel assemblies. (3) Licensees are not required to report commercial or military aircraft activity that is assessed as routine or non-threatening. (e) Suspicious activity—shipping activities. (1) For licensees subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, or § 73.37, the licensee must report activities they assess are suspicious. Examples include, but are not limited to, the following: (i) Challenges to the licensee's or its transportation contractor's communications subsystems regarding the transport system; (ii) Challenges to the licensee's or its transportation contractor's security subsystems for the transport system; (iii) Interference with or harassment of in-progress shipments; (iv) Elicitation of non-public information from knowledgeable licensee personnel or the licensee's transportation contractor personnel regarding transportation program elements, including: security programs, operations programs, communication protocols, shipment routes, safe haven locations, and emergency response programs; or (v) Observed surveillance or reconnaissance activity of ongoing shipments. (2) For licensees using a movement control center for shipments of radioactive material or special nuclear material (SNM), the movement control center may report suspicious activities to LLEA, the FBI, and the NRC, in lieu of the licensee making such reports. (f) Suspicious activities—enrichment facilities. (1) For licensees subject to the provisions of § 73.67, who are also engaged in the enrichment of SNM using RD information, technology, or materials; the licensee must report activities they assess are suspicious. Examples include, but are not limited to, the following: (i) Aggressive noncompliance by visitors to the licensee's facility involving willful unauthorized departure from a tour group or willful unauthorized entry into restricted areas; (ii) Unauthorized recording or imaging of sensitive technology, equipment, or materials; or (iii) Elicitation of non-public information from knowledgeable licensee or contractor personnel regarding physical or information security programs intended to protect RD information, technology, or materials. (2)(i) Licensees must report, in accordance with § 95.57 of this chapter, alleged or suspected activities involving actual, attempted, or conspiracies to obtain RD, communicate RD, remove RD, or disclose RD in potential violation of Sections 224, 225, 226, and 227 of the Atomic Energy Act of 1954, as amended (42 U.S.C. 2274, 2275, 2276, and 2277). (ii) As an exemption, the licensee is not required to also report such actual, attempted, or conspiracies to obtain RD, communicate RD, remove RD, or disclose RD as suspicious activities pursuant to this section. (g) Suspicious activities—exemptions. (1) Licensees subject to § 73.67 who possess strategic special nuclear material in quantities greater than 15 grams but less than the quantity necessary to form a critical mass, as specified in § 150.11(a) of this chapter, are exempt from the provisions of this section. (2) The following licensees are exempt from the provisions of this section: (i) Docket number 70-7020; and (ii) Docket number 70-7028.

Starting a business? Corpus forms LLCs in all 50 states and DC.