9
Ensuring Security and Promoting Safeguards
Security, safeguards, and safety all focus on the reduction of risk and the protection the environment and society from release or loss of regulatory control of radioactive materials. Security seeks to address intentional threats (e.g., malicious events such as theft, sabotage, insider threats, cyber-attacks, terrorism) and the consequences of such events. Safeguards cover a specific aspect of security by addressing threats of diversion of special nuclear material1 from legitimate civilian applications by a State actor for the purpose of weapons development.2 Safety addresses the risk of accidental events (such as natural hazards, equipment failures, or human error). Safety, security, and safeguards are often discussed together as the “3Ss.” This report discusses safety in the context of advanced reactor designs (see Chapter 2) and of U.S. Nuclear Regulatory Commission (NRC) regulatory requirements (see Chapter 7). Security and safeguards are the focus of this chapter.
Future nuclear power reactors deployed in the United States or internationally will have to demonstrate that they are secure from malicious threats, both physical and cyber. New and advanced reactors deployed in non-nuclear weapons states will also need to demonstrate that nuclear material and information are protected from diversion and misuse for nuclear weapons. This chapter describes the means that support the security of civilian nuclear power facilities and that ensure proper safeguarding of nuclear material and information within a nuclear facility.3 The committee highlights the challenges of ensuring security and safeguards at new and advanced reactors and their new deployment scenarios and provides recommendations.
SECURITY
Security in the United States is regulated by the NRC in 10 CFR Part 73 and in the case of power reactors is reflected in a series of plans: a Physical Security Plan, a Training and Qualification Plan, a Safeguards Contingency Plan, and a Cyber Security Plan.4 The committee focuses first on physical security.
___________________
1 Special nuclear material includes plutonium, uranium-233, and uranium enriched in the isotope uranium-233 or in the isotope uranium-235. The definition can be expanded by the NRC to include other nuclear materials, but the NRC has not done so.
2 This description of safeguards is consistent with international safeguards, implemented by the IAEA. U.S. domestic material control and accounting (MC&A) measures aim to ensure nuclear materials are not diverted for any use, and IAEA international safeguards aim to ensure that nuclear materials are not used in the development of weapons by State actors, in accordance with international non-proliferation treaties.
3 The terms used here, nuclear power facilities and nuclear facility, highlight that security and safeguards are applied to the broader nuclear facility complex and not simply the nuclear reactor.
4 See U.S. Nuclear Regulatory Commission Regulations, n.d., “Title 10, §73.55(a)” in Code of Federal Regulations, Washington, DC: Government Publishing Office and National Archives and Records Administration.
Physical Security
The security framework applicable to reactors is designed to protect against a design basis threat (DBT) of radiological sabotage.5 In the case of existing large LWRs, the security framework is designed to prevent significant damage through sabotage of the core and spent fuel. The DBT is based on current assessments of the tactics, techniques, and procedures of international and domestic terrorist groups and organizations. The specific details of the DBT are not publicly available, but, in general, the DBT outlines threats and adversary characteristics against which a licensee must demonstrate it can defend its facility.6 In addition, other open-source information on current and potential threats could impact the development and deployment of new and advanced reactors.7
Nuclear power plants (NPPs) are, by design and construction, difficult to penetrate. Security at existing NPPs is subject to detailed prescriptive regulation.8 The combination of robust structures that are difficult to penetrate, a well-armed professional security force, intrusion detection, strict access controls for workers and visitors, and multiple backup safety systems provides multiple layers of security.
Physical security is based on three concentric circles, with the level of security increasing as one gets closer to vital equipment. The large outer perimeter, called the “owner-controlled area,” is far enough from the reactor that only minimal security is needed. The “protected area” is fenced and protected by sophisticated security systems and armed security officers. The innermost circle is called the “vital area.” It contains the reactor and associated safety systems, the control room, the used fuel pool, and the security alarm stations. Access to the vital area is limited and protected by locked and alarmed security doors. The NRC requirements also cover protections against insider threats, continuous communication capability, lighting, electronic surveillance and physical patrols of the plant perimeter and interior structures, robust barriers to critical areas, and background checks and access control for employees, among many other elements. In addition, each plant has an integrated security and response plan with federal, state and local law enforcement agencies. The security plan is subject to inspection, as well as triennial “force-on-force” exercises to verify its effectiveness. The NRC is required to provide an annual report to the Congress in both classified and unclassified form of the results of each security evaluation and of any resulting corrective actions. The unclassified report is widely available. 42 USC 2010d.
The advanced reactor designs and deployment scenarios are far different from conventional nuclear power reactors. For example, some of the reactor designs have features that might decrease security risk and justify modification of some of the physical protection requirements. These features include the following:
- Smaller source term. Some of the designs have smaller power outputs in comparison to operating large LWRs, with a correspondingly smaller inventory of fission products; of course, if multiple units are sited at one location, the total source term will have to be evaluated.9
- Design features aimed at reducing vulnerabilities. Many of advanced reactors use simplified, inherent, and/or passive design features that reduce the vulnerabilities that might be exploited by an attacker.
- Underground protection. Housing the reactor below ground level, as some designs have done, could limit access to vital equipment by an intruder and protect the plant from an aircraft attack.
___________________
5 See U.S. Nuclear Regulatory Commission Regulations, n.d., “Title 10, §73.1 and §73.55” in Code of Federal Regulations, Washington, DC: Government Publishing Office and National Archives and Records Administration.
6 See U.S. Nuclear Regulatory Commission Regulations, n.d., “Title 10, §73.1(a)” in Code of Federal Regulations, Washington, DC: Government Publishing Office and National Archives and Records Administration.
7 See, for example, Office of the Director of National Intelligence, 2022, “Annual Threat Assessment of the U.S. Intelligence Community,” Office of the Director of National Intelligence, https://www.dni.gov/files/ODNI/documents/assessments/ATA-2022-Unclassified-Report.pdf. For a review of methods for proliferation risk assessment, see National Research Council, 2013, Improving the Assessment of the Proliferation Risk of Nuclear Fuel Cycles, Washington, DC: The National Academies Press. https://doi.org/10.17226/18335.
8 See U.S. Nuclear Regulatory Commission Regulations, n.d., “Title 10, §73.55” in Code of Federal Regulations, Washington, DC: Government Publishing Office and National Archives and Records Administration.
9 Note that the advantage of less fuel in a given unit is reduced if the deployment involves multiple individual units comprising a single power generating facility.
However, some of the designs and deployment scenarios (see Chapter 2) increase security risks and present new security challenges, including:
- Remote operation. Advanced reactors deployed to remote regions of the United States and the world that have minimal existing security infrastructure may require additional active and passive delay elements that increase task completion times for malicious actors (Evans et al. 2021a). Remote operations also raise unique challenges regarding cyber security (see the next section).
- Reduced staffing. Some operating models propose smaller numbers of on-site security staff, compared to conventional nuclear power facilities. Fewer on-site staff may reduce the potential insider threat for the facility, but also may reduce the capability to repel an attacker. (Duguay 2020).
- Security of fuels. Some of the new and advanced reactors rely on high assay low-enriched uranium (HALEU) fuel,10 which is more attractive for diversion or theft than LEU and may require additional security measures. Other designs require recycling of spent fuel, creating opportunities for diversion or theft of weapons-usable fissile materials.
- Transportable facilities. Some designs allow for the transport of the nuclear power facility with its fuel, such as some microreactor designs (see Chapter 7). Security guidance exists for transporting nuclear materials, which have different threats and physical security measures than for materials stored in a stationary and secure location (IAEA 2015).11
The NRC has engaged with reactor vendors and other stakeholders with regard to the physical security requirements appropriate to advanced reactors and in 2018 the Commission approved the commencement of a limited scope rulemaking that, while retaining the current overall physical security framework, would provide specific alternative requirements that could be applied at advanced reactors (NRC 2018). In August 2022 the NRC staff sought authorization from the Commission to publish a proposed rule that would offer voluntary performance-based alternatives for meeting certain physical security requirements for advanced reactors (NRC 2022). The proposed rule would make available alternative performance-based requirements for applicants and licensees that meet a proposed eligibility criterion. That criterion would require a demonstration that the consequences of a postulated release arising from a security-related event do not exceed a specific offsite dose limit.12 That is, the proposed changes would be available only if the offsite consequences of a radioactive release from the facility are limited.
The alternative security arrangements for eligible applicants have the following elements:
- The licensee would be relieved from the requirement to provide a minimum number of armed responders (currently a minimum of 10 is required), potentially allowing no onsite armed responders.
- The licensee could rely on law enforcement (local, state, or federal) or other offsite armed responders rather than using armed onsite licensee security personnel. The licensee would still be required to show the capacity of detect, assess, interdict and neutralize threats up to the level defined by the DBT.13
___________________
10 High-assay LEU (or HALEU) is uranium enriched in U-235 between 5 percent and 20 percent. Although HALEU above 10 percent enrichment is subject to stronger security than LEU (10 CFR 73.2), it cannot be used in a nuclear weapon absent further enrichment. As a result, the concerns about HALEU focus on the potential to use HALEU as enrichment feedstock to produce high-enriched uranium (HEU), which is typically enriched to 90 percent or greater in a nuclear weapon.
11 See National Academies of Sciences, Engineering, and Medicine, 2023, Merits and Viability of Different Nuclear Fuel Cycles and Technology Options and the Waste Aspects of Advanced Nuclear Reactors, Washington, DC: The National Academies Press, https://doi.org/10.17226/26500.
12 The dose limit for an individual on the outer boundary of the exclusion area is 25 rem total effective dose equivalent (TEDE) over any 2-hour period and 25 rem for an individual located at any point on the outer boundary of the low population zone. See U.S. Nuclear Regulatory Commission Regulations, n.d., “Title 10, §50.34(a)(1)(ii)(D)” in Code of Federal Regulations, Washington, DC: Government Publishing Office and National Archives and Records Administration.
13 The Department of Energy Order 151.1 requires DOE to establish an emergency management system (DOE 2023). In response, DOE has developed a set of emergency response guidelines and training programs together with contractors, state, tribal, and local jurisdictions. One program is focused on transportation emergency preparedness (Transportation Emergency Preparedness Program 2023). While recognizing that federal agency’s responsibilities are different from a licensee’s obligations, there may still be lessons learned or materials of use in DOE’s emergency preparedness programs for licensees of advanced reactors.
- The licensee would be allowed to apply means other than physical barriers to achieve the intended delay functions for armed security responses. These means might include the use of engineered systems (e.g., obscurants, irritants, slippery agents) and/or human actions.14
- The licensee would be allowed to locate the secondary alarm station offsite.
- If the licensee were to locate the secondary alarm system offsite, it would not be required to designate the secondary alarm station as a vital area and locate the secondary power supply for the secondary alarm station as a vital area.
The path to a final rule governing security for advanced reactors is likely to be a long one. The proposed rule will be released for public comment only after Commission review and possible modification. Then after comments are received and any changes to the proposed rule are made, the final rule must again receive Commission approval before promulgation. It then might undergo review in the courts. In the meantime, the staff has indicated that it will prepare guidance to explain the demonstrations that it would require from an applicant seeking to apply the new requirements.
Once the tailored approach framework is in place, the NRC will require advanced reactor vendors to validate their claims about adequate security, especially for applications that include significant reductions in on-site security staff or the use of novel technologies to enhance site-security, such as increased reliance on integrated sensors, automated barriers, or drone systems for detection and response. Such validation would likely require a combination of path analysis adversary modeling and evaluation of accident progression scenarios most applicable to the wider range of deployment options that some vendors envision.
Finding and Recommendation
Finding 9-1: The U.S. Nuclear Regulatory Commission (NRC) staff has proposed significant modifications to physical security requirements to accommodate designs and operations proposed by licensees of advanced reactors that differ from larger light water power reactors. There are many hurdles, including new assessments without clear NRC guidance on compliance demonstrations and a fuller understanding of the vulnerabilities that the new designs and deployment scenarios may present. These issues must be evaluated and any capacity/capability shortfalls in NRC expertise must be overcome before any such modifications can be applied by vendors.
Recommendation 9-1: The modification of the security requirements proposed by the U.S. Nuclear Regulatory Commission (NRC) staff could have significant implications for the design, staffing, and operations of advanced reactors, thereby impacting business plans. Delays in providing clear regulatory guidance may impact capital availability and increases the potential for costly redesign if guidelines do not align with expected modifications to existing protocols. Congress should provide additional funding for NRC evaluation of security guidelines and NRC should expedite its consideration of the staff proposal and seek to complete the rule making promptly if significant changes are deemed appropriate. In that case, the prompt completion of the associated guidance should also be a high priority.
Cyber Security Challenges
NPPs are monitored and controlled through a collection of instrumentation and control (I&C) systems including reactor protection and control systems, secondary plant control systems, and (reactor) health monitoring systems. The design of individual I&C systems for reactor control and protection is directly correlated to the
___________________
14 Some early studies on physical protection requirements for advanced reactors and their deployment scenarios have indicated that the proposed facility design scenarios would benefit from additional protections (Evans et al. 2021a), such as additional and hardened exterior walls, hardened doors, installation of multiple mantraps/airlocks, and obscurants. Other methods for increasing physical protection not analyzed in Evans et al. (2021a) include the use of drones for monitoring and response, integrated sensors, and automated barriers.
type and design of the reactor and its related safety systems. New designs for advanced nuclear reactors envision “passive” safety and control systems that would function without the need for external sources of power or control but would still require an operable I&C system with accurate inputs to monitor conditions.
Licensees of NPPs are required to have a cybersecurity plan that meets requirements laid out in 10 CFR 73.54. These requirements ensure that the functions of critical systems and digital assets are protected from cyberattack throughout the system engineering life cycle, using a graded approach.15 Guidelines for complying with the 10 CFR 73.54 requirements are spelled out in NRC Regulatory Guide 5.71 (NRC 2010).16 Each advanced reactor vendor is required to develop a cybersecurity plan and maintain a cybersecurity program as part of security protocols.
Advanced reactor vendors face significantly different challenges than the designers of the existing LWR fleet. Increased use of automation, wireless sensors and controls, and digital management of a complex operations and supply chain may create opportunities for reducing human error in such systems. They also mean that the threat spectrum may be significantly enhanced in some respects for the new design. Ultimately, because of this new and growing risk category, there will certainly be increased scrutiny from the NRC in licensing and ongoing assessment/regulation of these new control, protection and asset management systems.17
The Nuclear Energy Institute (see NEI 08-09, Revision 6) has provided further guidance targeted to new vendors to help them address the multiple challenges they face in meeting cyber guidelines (NEI 2010, 2016). It will be vital for each vendor to ensure that their security plans address the threat/attack pathways as they apply to their specific designs. They must also continuously evaluate risk and update their security protocols and system upgrades as appropriate, as spelled out in 10 CFR 73.54, to ensure all cyber threats are mitigated. Although digital I&C offers the promise of reduced staff and reduced vulnerability to some types of human error, and thereby reduced costs, the need to ensure cybersecurity could impose different new operating costs and can introduce new accident vulnerabilities. Claimed cyber security protocols must be tested and regularly validated. Vendors must incorporate sufficient cybersecurity controls to ensure safety and guarantee asset protection and manufacturing facility protection across the product life cycle.
Finding and Recommendation
Finding 9-2: Advanced reactor designers envision increased use of automation and the potential for use of artificial intelligence–enabled sensors and controls to reduce staff costs, enhance the robustness of defenses, and, in some cases, provide for remote, multi-asset operations. These systems could increase cybersecurity risk, with some resulting security cost burden over the operating life of the reactor.
Recommendation 9-2: The U.S. Nuclear Regulatory Commission (NRC) must ensure the safety and security of new designs, especially for designs that employ greater automation and incorporate remote operating options. Claimed cybersecurity protocols should be tested and regularly validated across the full life cycle of the facility. Licensees should incorporate sufficient cybersecurity controls to ensure safety and guarantee asset protection and manufacturing facility protection across the product life cycle. Both the NRC and the vendors should work closely with the International Atomic Energy Agency’s Small Modular Reactor and Instrumentation and Control Systems groups to develop international standards and determine whether new monitoring alternatives are needed.
___________________
15 The IAEA defines “graded approach” as: a structured method by which the stringency of control to be applied to a product or process is commensurate with the risk associated with a loss of control (IAEA 2014).
16 The Regulatory Guide provides an approach for complying with the requirements outlined in 10 CFR 73.54. See U.S. Nuclear Regulatory Commission, 2010, “Regulatory Guide 5.71: Cyber Security Programs for Nuclear Facilities,” https://www.nrc.gov/docs/ML0903/ML090340159.pdf.
17 See, for example, NRC, 2008, “Instrumentation and Controls in Nuclear Power Plants: An Emerging Technologies Update,” NUREG/CR-6992.
SAFEGUARDS
The term safeguards refers to the monitoring of nuclear material and information to reduce the risk of diversion of special nuclear material. In the United States, the NRC has a set of regulations via 10 CFR Part 74 that require licensees to establish, maintain, and provide reporting of special nuclear material through material control and accounting (MC&A) measures, serving both a safeguards and security purpose.18 Internationally, the term safeguards refers to “a set of technical measures applied by the [International Atomic Energy Agency] on nuclear material and activities, through which the Agency seeks to independently verify that nuclear facilities are not misused and nuclear material not diverted from peaceful uses [by State actors]” (IAEA 2016). The IAEA independently establishes and monitors the MC&A measures for the nuclear facility (Garrett et al. 2021, pp. ii–iv). United States vendors will need to incorporate both types of MC&A measures into their facilities and processes if they plan to market their systems both in the United States and internationally. The additional elements imposed by the IAEA include surveillance and monitoring equipment accessible by the IAEA to verify that nuclear material has not been diverted.
Under current international standards, each nation bears the responsibility for securing nuclear (and other radiological) materials and relevant facilities and activities within their borders. The IAEA and its state parties identify specific sets of measures for protecting nuclear materials and information through safeguards agreements. As a recognized nuclear weapons state under the Treaty on the Non-Proliferation of Nuclear Weapons (NPT), the United States is not required to conclude a safeguards agreement with the IAEA. Non-nuclear weapons States that have entered into the NPT, and in some instances groups of nations (e.g., EURATOM, the European Atomic Energy Community, enter into safeguards agreements with the IAEA to allow verification of compliance with the NPT (IAEA 2002). Although the United States has no obligation to accept IAEA safeguards under the NPT, the U.S.-IAEA Voluntary Offer Agreement (as implemented through 10 CFR Part 75) allows a small number of domestic facilities to be subject to international safeguards and inspection by the IAEA. The advantages are two-fold: to allow the IAEA to gain experience in implementing new safeguards technologies and in testing of new safeguards equipment, and to demonstrate that the United States is willing to follow the same rules as the non-nuclear weapons states.
Advanced reactors present new MC&A and safeguards challenges because they use new fuels and fuel cycles, new reactor designs, longer operation cycles, new supply arrangements, new spent fuel management, diverse operational roles, and unattended monitoring systems (Cipiti 2022). Some safeguards and materials control and accounting challenges will also depend on the design and location of the facility, such as deployments in remote locations.
The U.S. companies currently developing advanced reactors are taking substantially different technical approaches in their designs. At the same time, most U.S. nuclear facilities are not subject to safeguards requirements, so many in the U.S. nuclear industry are not fully familiar with these requirements. In some cases, new sensors and other instrumentation need to be developed and commercialized to enable a successful safeguards strategy.19 These safeguards strategies, reflecting both national and international safeguards obligations, will likely reflect a balance of different risks and rewards. For example, some designs call for less frequent refueling (a more proliferation-resistant design element) but use higher enriched fuels, such as HALEU (a less proliferation-resistant design element).
The most significant safeguards technology gaps exist for continuously fueled reactors (e.g., liquid-fuel reactors), such as molten salt reactors. During operation, the actinides and fission products are contained within a liquid salt, which serves as both fuel and primary coolant for molten salt reactors. Some actinides and fission products are dissolved within the salt, and others exist as colloidal particles. The isotopic concentration of these products changes continually over time.20 Furthermore, the salt may not be strictly homogeneous—the concentrations of
___________________
18 As noted in an earlier footnote, U.S. domestic material control and accounting (MC&A) measures aim to ensure nuclear materials are not diverted for any purpose. IAEA international safeguards aim to ensure that nuclear materials are not used in the development of weapons by State actors, in accordance with international non-proliferation treaties.
19 For example, pebble bed and liquid fueled reactors may require new sensors and instrumentation for material inventory control.
20 The isotopic content evolves during reactor operation owing to four main processes: (1) plate-out of noble and semi-noble metals, (2) active removal of gaseous fission products, (3) online reprocessing of fuel salt, and (4) online refueling.
materials may vary throughout the primary loop, for example as a function of temperature. Additionally, the coolant used in liquid fueled reactors (and in reactors that employ lead or sodium as a coolant) is opaque. Simply put, the use of continuous fuel changes the nature of the MC&A and safeguards requirements by effectively combining a nuclear reactor, a fuel fabrication facility, and a fuel reprocessing facility. Adding to these challenges, the operational temperature and radioactivity of a continuous fueled reactor, require MC&A and safeguards instrumentation to survive and operate reliably in harsh environments.
One potentially positive aspect of these challenging safeguards conditions is that molten salt and other liquid fuels increase the technical sophistication that would be required to divert material, requiring specialized equipment for processing and transport, thereby making diversion challenging, dangerous, and costly (Prasad et al. 2015). To exploit this advantage, however, the technical safeguards solutions must be validated and must prove reliable, which could lengthen regulatory timelines.
MC&A and safeguards difficulties also exist in systems using pebble fuel.21 In a pebble bed reactor, for example, the different fuel pebbles cannot be distinguished from one another, and currently do not have specific serial numbers, so the pebbles are considered to be a bulk material (Boyer et al. 2010).
Fortunately, the IAEA has experience in applying safeguards at pebble bed reactors in Germany (AVR and THTR-300, no longer operating, see Martin 1987) and China (HTR-10, operating since 2004, and HTR-PM, operating since December 2021). However, the IAEA has no prior safeguards experience with molten salt reactors. IAEA’s experience from establishing safeguards at an aqueous reprocessing facility, the Rokkasho Reprocessing Plant in Japan, and at fuel fabrication and bulk facilities may be relevant for any future work at molten salt reactors (Garrett et al. 2021).22
Enhancing advanced reactor safeguards, especially for the particularly challenging case of continuous liquid fueled systems, requires addressing some key technology gaps.23 Pebble bed reactors will require measuring the final isotopic content when pebbles may have differing burnup histories or different initial enrichment levels, requiring the advancement of technologies such as radioisotope pebble tagging, predictive pebble tracking, burnup estimation, and NDA techniques.24 For continuous liquid fueled reactors, instrumentation capable of making the following measurements is needed:25
- Determining isotopic composition of the liquid fuel, considering potential inhomogeneity
- Volume of salt in key areas: reactor core, pumps, processing tanks, storage tanks
- Identification of volumetric changes (deliberate or unintentional) as a function of time
- Materials flow monitoring
- Isotopic composition of gases.
___________________
21 Pebble fuels, such as TRISO particles, are seen as having higher proliferation resistance as compared to traditional reactor fuels owing to the small amount of U-235 within each pebble and the difficulty of extracting U-235 from the pebble’s matrix (Cheng 2021).
22 For proposed domestic safeguards for pebble-bed reactors, see D. Kovacic, P. Gibbs, and L. Scott, 2020, Model MC&A Plan for Pebble Bed Reactors, Letter Report for Technical Direction #5 Task 2.6 (ORNL/SPR-2019/1329), https://info.ornl.gov/sites/publications/files/pub132501.pdf.
23 See the following research papers and presentations related to R&D on MSR MC&A and safeguards technology: D.E. Holcomb, R.A. Kisner, and S.M. Cetiner, 2018, Instrumentation Framework for Molten Salt Reactors, ORNL-TM/2018-868, https://info.ornl.gov/sites/publications/Files/Pub111607.pdf; M. Croce, K. Koehler, K. De Castro, et al., 2020, Experimental Validation of Nondestructive Assay Capabilities for MSR Safeguards, https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Reading/Experimental%20Validation%20of%20NDA%20for%20MSR%20Safeguards%20FY20%20Report.pdf; A.M. Lines, H.M. Felmy, A.S. Medina, et al., 2020, Evaluation of Optical Techniques for Molten Salt Reactor Materials Control and Accounting, Pacific Northwest National Laboratory, https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Reading/Evaluation%20of%20Optical%20Techniques%20for%20Molten%20Salt%20Reactor%20Materials%20Control%20and%20Accounting%20-%20PNNL.pdf; N. Hoyt and C. Moore, 2021, Flow Enhanced Electrochemical Sensors for Molten Salt Reactors, Argonne National Laboratory, https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Presentations/Safe_Secure_Day3_Website/04-Flow%20Enhanced%20Electrochemical%20Sensors%20for%20MSRs-Hoyt.pdf.
24 List from the Garrett et al. 2021, p. 33.
25 Notably, the IAEA safeguards approach developed at Rokkosho resulted in more than 50 monitoring and measuring systems plus dozens of cameras required to track assemblies, measure and monitor radioactive solutions, and verify the final product and waste streams (Garret et al. 2021, p. 37).
Robust measurement instrumentation for pebble bed and continuously liquid fuel reactors does not yet exist but is needed to provide accurate measurements of inventories in materials balance areas and track the flow of materials throughout the plant.
Efforts within the United States and the IAEA are in the early stages of exploring potential approaches that would provide the IAEA and regulatory authorities with greater assurance when making safeguards determinations such as: continuous on-line enrichment monitoring, satellite imagery analysis, remote data transmission, and environmental sampling (Maceda et al. 2022).
Finding and Recommendation
Finding 9-3: As advanced reactors continue to be developed with the potential of rapid scale-up both domestically and internationally in the coming decades, it is crucial to recognize, prioritize, and address potential gaps in safeguards technology and to incorporate key measurement capabilities at the earliest stages of the design process. Several initiatives in the United States and within the International Atomic Energy Agency have begun to address these challenges.
Recommendation 9-3: The International Atomic Energy Agency (IAEA) and Department of Energy (DOE) should identify the funding, personnel, regulatory analyses, and key technology gaps for pilot programs in international safeguards for advanced reactors. There is also a need for the vendors to engage early in their designs to fully understand IAEA safeguards requirements and implementation. Because the first vendors will bear the largest cost burden in developing and implementing safeguards for new advanced reactor designs that other vendors may incorporate, the IAEA and DOE should develop cost incentive-based programs to encourage early-adopter vendor participation in safeguards development.
SAFETY, SECURITY, AND SAFEGUARDS BY DESIGN
There is an important synergy among safety, security, and safeguards—the 3Ss. In some instances, risk reduction efforts in one domain reduces risks in all three. Controlling access to nuclear materials at a nuclear facility, for example, helps limit accidental exposures to radiation (safety), prevents theft (security), and prevents the sabotage of seals or surveillance devices (safeguards). In other instances, however, reducing risks in one domain increases risks in others. For security purposes, for example, facilities may want to delay potential attackers, which can increase the barriers for rapid access by emergency services in case of an accident or limit the activities of safeguards inspectors.26 Efficient and effective nuclear facility design is best achieved when requirements from the 3S disciplines are anticipated and intrinsic to the facility design. In that way the implications of a design element on each of the 3Ss can be evaluated and appropriate trade-offs, if necessary, can be made.
The failure to consider the implications of each domain on the others from the outset of design is likely to increase both capital and operating costs and may limit the effectiveness of the response to 3S challenges. The appropriate balance can be achieved through an understanding of the requirements in each arena and considering them during all phases of the design process (Snell 2013). 3S by design from the earliest stages promises to avoid costly retrofitting of reactor designs and facilities. For example, enhanced security requirements were imposed on the fleet of operating nuclear reactors as a result of the 9/11 attack. The need to back-fit enhanced security features on established plants led to significant capital expenditures and increased operating costs.
New and advanced reactors will not be immune to the 3S challenge. The IAEA held a webinar on the topic in February 2022, and a technical meeting on 3S in the design of SMRs in June 2022 (IAEA 2022a, Iturria and Li 2022). Participants in the technical meeting recognized that more must be done to raise awareness about the 3Ss, especially for security and safeguards issues compared to the better-known safety issues and recommended that the IAEA provide guidance on 3S by design for SMRs and take a more holistic 3S approach to its work (Iturria and Li 2022). U.S. vendors would benefit from participating in the development of 3S-by-design guidance, along with
___________________
26 The complications from the interface between safety and security have attracted more attention than the interface with safeguards. See, for example, IAEA (2010).
developments in security-by-design and safeguards-by-design, such as the early work by the IAEA on increased regulatory collaboration or the efforts to promote standardization of advanced reactor manufacturing, construction, and operation (Liou 2022b).
Finding and Recommendation
Finding 9-4: Consideration of safety, security, and safeguards requirements—individually as well as their interactions—at the beginning of and throughout the advanced reactor design process by the vendors will avoid unnecessary costs and complications.
Recommendation 9-4: Vendors bear the responsibility of demonstrating compliance of their designs with safeguards, security, and safety requirements, including International Atomic Energy Agency safeguards requirements for reactors sold to non-weapons states. Vendors should recognize that these requirements are interrelated with each other and should ensure that any necessary trade-offs are made early in the design process.
CURRENT U.S. GOVERNMENT AND IAEA INITIATIVES
Both the U.S. government and IAEA have developed programs promoting security and safeguards within advanced reactor designs and deployments.27 Historically, the United States has created partnerships with several countries, such as Japan and the Republic of Korea, that have adopted high standards for safeguards and security. Given the potential for increased deployment of nuclear reactor systems around the world to address climate change, the U.S. Congress has supported—and in some cases mandated—increased support of U.S. efforts focused on security and safeguards by DOE and the NRC. In earlier chapters of this report, DOE-NE’s programs and investment in advanced nuclear have been discussed as well as the NRC’s international engagement (see Chapter 7). Here the committee focuses on programs targeted for implementation of security and safeguards in the international deployment of advanced reactors.
U.S. Government Initiatives
Defense Nuclear Non-proliferation (DNN) (through the NNSA Office of Non-Proliferation and Arms Control) has established the Advanced Reactor International Safeguards Engagement (ARISE) program with an international focus and the Advanced Reactor Safeguards (ARS) program with a U.S. domestic R&D focus.
ARISE supports effective and efficient IAEA safeguards implementation by engaging with the U.S. advanced reactor community to educate stakeholders on IAEA safeguards and promote timely incorporation of international safeguards by design (DOE-NNSA 2017, 2022). A congressionally mandated program, ARISE connects vendors with DOE national laboratory experts to assist with incorporating international safeguards by design into early design development.
The ARS program applies laboratory R&D to address near-term challenges advanced reactor vendors face in meeting U.S. domestic safeguards (Material Control and Accounting [MC&A] and Physical Protection System [PPS] requirements [Cipiti 2021, slide 2; Cipiti 2022]). ARS has the following thrust areas:28
- Thrust Area 1: Developing a Robust and Cost-Appropriate Physical Protection Systems (PPS)
- Thrust Area 2: Develop MC&A Approaches for Pebble Bed Reactors
- Thrust Area 3: Determine MC&A and PPS Requirements for Microreactors
- Thrust Area 4: Develop MC&A Approaches for Molten Salt Reactors
- Thrust Area 5: Leverage International Interfaces
___________________
27 Both DOE-NNSA and the IAEA have gathered sets of documents to guide safeguards by design development efforts. DOE-NNSA guidance at https://www.energy.gov/nnsa/downloads/safeguards-design-guidance-documents; IAEA guidance at https://www.iaea.org/topics/assistance-for-states/safeguards-by-design-guidance.
28 For the most recent reports for each thrust area see Gateway for Accelerated Innovation in Nuclear, 2023, “Advanced Reactor Safeguards,” https://gain.inl.gov/SitePages/ARS.aspx.
The ARS program has released a number of useful reports within each thrust area and referenced throughout this chapter. The committee agrees with the following statement made in Advanced Reactor Safeguards: Lessons from the IAEA Safeguards Domain:
A final general need area is for advance coordination and information sharing between stakeholders. As mentioned previously, the specific domestic MC&A and IAEA safeguards needs will likely vary for different facility types, and domestic and international requirements will continue to evolve. Coordination at appropriate intervals involving facility designers, U.S. government stakeholders (including DOE/NNSA) and the IAEA will help identify problems proactively and help navigate interfaces between domestic MC&A and IAEA safeguards. This is particularly true for facilities such as liquid-fueled MSRs that may have especially complex MC&A systems. (Garrett et al. 2021, p. 42)
Support provided to vendors under these DOE NNSA programs is typically coordinated through the U.S. National Laboratory System. To ensure the protection of vendor intellectual property, the individual engagements generally include a non-disclosure agreement. In order to simplify engagement, DOE NNSA has also developed an online presence, U.S. Nuclear Nexus to support safeguards and security engagement.29 The U.S. national laboratories also have considerable experience in working with international partners and could offer lessons learned to all stakeholders on the infrastructure for cooperative ventures, especially on a range of knowledge management issues, such as export controls, intangible technology transfers, collaborating and hosting foreign nationals, and visa conditions.
DOE has also enhanced cross-domain research and development that will enable more rapid development efforts through a new program called ANSWER (an acronym for Advanced Nuclear Security, Waste and Energy R&D). ANSWER is supported by the DOE Offices of Science and Nuclear Energy and the NNSA (Lauren-Kovitz 2021). ANSWER’s working groups, consisting of a core group and technical subgroups, is the primary mechanism for addressing specific challenges. One of the initial technical subgroups is titled, “Incorporating Safeguards and Security by Design into Advanced Reactor and Fuel Cycle Technologies,” with an objective to “identify and resolve technical, regulatory, and policy challenges related to safeguards and security for advanced reactor and fuel-cycle technologies early in the design process and in close coordination with industry” (Lauren-Kovitz 2021, slide 6). Priority actions for the subgroup are (Lauren-Kovitz 2021, slide 6):
- Ensure necessary technical and policy support for U.S. vendors to complete physical protection design parameters for submission to NRC.
- Provide technical basis for advanced reactor and fuel cycle (e.g., Molten Salt Reactor, Pebble Bed, and Microreactor) materials accountancy system design and vital area/target set identification techniques.
- Support engagement between U.S. vendors and the IAEA to ensure that international safeguards and security requirements and best practices are incorporated into reactor designs.
The committee was not told which vendors were engaging with DNN programs or ANSWER initiatives.
IAEA Initiatives
Multilaterally, the IAEA offers a range of technical assistance to its Member States on nuclear safeguards and security, which has increased considerably over the past two decades. Most notable are its growing list of Nuclear Security Series guidance documents and the use of IAEA Integrated Nuclear Security Support Plans (INSSPs), where, upon request of the Member State, the IAEA helps identify and prioritize where a State may need to strengthen its national nuclear security regime, following the Nuclear Security Series Guidance, along with other relevant input, such as recommendations from International Physical Protection Advisory Service (IPPAS) and International Nuclear Security Advisory Service missions. More than 100 IAEA Member States
___________________
29 See U.S. Nuclear Nexus, 2023, “Your Resource to Engage with NNSA on Global Deployment of the U.S. Civilian Nuclear Technology,” https://nuclear-nexus.nsis.anl.gov/nexus.
have INSSPs under implementation or finalized (IAEA Director General 2021). The IAEA also maintains a Nuclear Security Information Portal (NUSEC), supports the work of national Nuclear Security Training and Support Centres (NSSCs) and the International Security Education Network (INSEN), maintains an Incident and Trafficking Database (ITDB), conducts dozens of national security training projects annually, and has developed several on-line nuclear security training modules (IAEA Director General 2021). Requests for assistance on nuclear security have increased, especially after the entry into force of the Amendment of the Convention on the Physical Protection of Nuclear Material (A/CPPNM) in 2016, prompted the IAEA to begin construction of its first Nuclear Security Training and Demonstration Centre in July 2021, with more than €11 million in extra-budgetary funding pledged from Saudi Arabia, the United Kingdom, and the United States (IAEA 2021b).
The increased role of nuclear security in IAEA activities has spread to encompass the IAEA’s work on new and advanced reactors. In 2015, the IAEA established a SMR Regulator’s Forum focused on licensing and safety issues, supplemented by the formation of a Technical Working Group on Small and Medium Sized or Modular Reactors (TWG-SMR) in 2018.30 In 2021, the IAEA began a nuclear security project for SMRs for the sharing of information on SMR security systems and how requirements and guidance from the Nuclear Security Series can apply to SMRs. This project will form the basis of future Series documents and training programs (IAEA Director General 2021).
The current regular budget for IAEA nuclear security and safeguard activities is €6.4 million for nuclear security and €133.5 million for safeguards implementation (IAEA 2020). The IAEA Division of Nuclear Security relies on extra-budgetary funding five or six times the amount of the regular budget to conduct its work (GAO 2019). Furthermore, the zero-growth constraints on the IAEA budget (IAEA 2022b, p. iii; GAO 2019, p. 10) and an unwillingness by some IAEA Member States to reapportion the budget from other activities (see GAO 2019, pp. 30–32) will impair efforts to make deployment of new and advanced reactors safeguarded and security without significant changes in the current funding stream. These initiatives that aid potential partners for deploying U.S. new and advanced reactors, either bilaterally through U.S. government initiatives or multilaterally through the work of the IAEA, likely will require a considerable increase in resources from the United States and the IAEA. It is also likely that the IAEA will need considerable increase in its budget to meet the safety, security, and safeguards objectives for new or expanded nuclear programs.
Finding and Recommendation
Finding 9-5: The U.S. government has established a robust set of programs and organizations that will support advanced reactor developers across the spectrum of research, development, and deployment, including support for domestic and international safeguards and security research, international engagement, and licensing assessment. In addition, the United States and the International Atomic Energy Agency have initiated complementary programs to support the long-term effort needed to develop effective nuclear frameworks for the deployment of new and advanced reactors.
Recommendation 9-5: The United States should develop a plan for increased and sustained long-term financial and technical support for capacity building in partner countries, including cost requirements for using U.S. national laboratories and universities as training platforms. This plan should include partnering with U.S. reactor vendors to develop a safety, safeguards, and security “package,” where the United States and the vendor could offer customized support to a host country for developing and implementing new safety, safeguards, and security arrangements.
___________________
30 TWG-SMR includes the following Member States: Argentina, Australia, Canada, China, Finland, France, India, Indonesia, Iran, Italy, Japan, Jordan, Kenia, Republic of Korea, Pakistan, Russian Federation, Saudi Arabia, South Africa, Ukraine, United Kingdom, United States. See IAEA (2019).
REFERENCES
Boyer, B.D., D.H. Beddingfield, P. Durst, and R. Bean. 2010. Pebble Bed Modular Reactor Safeguards: Developing New Approaches and Implementing Safeguards by Design. No. LA-UR-10-01760; LA-UR-10-1760. Los Alamos, NM: Los Alamos National Lab.
Cheng, L. 2021. White Papers on Proliferation Resistance and Physical Protection: Characteristics of the Six GEN IV Nuclear Energy Systems. BNL-222075-2021-COPR. Submitted to the White Papers on Proliferation Resistance and Physical Protection Characteristics of the Six GEN IV Nuclear Energy Systems Conference. https://www.osti.gov/servlets/purl/1818921.
Cipiti, B. 2021. “Advanced Reactor Deployment: Safeguards and Security Challenges.” Presented to the Committee. October 4. https://www.nationalacademies.org/event/10-04-2021/laying-the-foundation-for-new-and-advanced-nuclear-reactors-in-the-united-states-meeting-8#sectionEventMaterials. Available by request through PARO@nas.edu.
Cipiti, B. 2022. Advanced Reactor Safeguards: 2022 Program Roadmap. SAND2022-11143R. Sandia National Laboratories. https://doi.org/10.2172/1884929.
Croce, M., K. Koehler, K. De Castro, D. Mercer, S. Weidenbenner, M. Carpenter, D. Vo, D. Henzlova, and H. Menlove. 2020. Experimental Validation of Nondestructive Assay Capabilities for MSR Safeguards. https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Reading/Experimental%20Validation%20of%20NDA%20for%20MSR%20Safeguards%20FY20%20Report.pdf.
DOE (Department of Energy). 2023. “DOE O 151.1D Chg1 (MinChg), Comprehensive Emergency Management System.” https://www.directives.doe.gov/directives-documents/100-series/0151.1-BOrder-d-chg1-minchg.
DOE-NE (Office of Nuclear Energy). 2021. “U.S. Department of Energy Seeks Input on Creation of HALEU Availability Program.” https://www.energy.gov/ne/articles/us-department-energy-seeks-input-creation-haleu-availability-program.
DOE-NNSA (National Nuclear Security Administration). 2017. “Safeguards by Design Guidance Documents.” https://www.energy.gov/nnsa/downloads/safeguards-design-guidance-documents.
DOE-NNSA. 2022. “Advanced Reactor International Safeguards Engagement Program.” https://uploads.mwp.mprod.getusinfo.com/uploads/sites/54/2022/05/ARISE-Fact-Sheet_PA-Cleared_04152022.pdf.
Duguay, R. 2020. “Small Modular Reactors and Advanced Reactor Security: Regulatory Perspectives on Integrating Physical and Cyber Security by Design to Protect Against Malicious Acts and Evolving Threats.” International Journal of Nuclear Security 7(1):Article 2. https://doi.org/10.7290/ijns070102.
Evans, A., J. Parks, S. Horowitz, L. Gilbert, and R. Whalen. 2021a. “U.S. Domestic Small Modular Reactor Security by Design.” SAND2021-0768. Albuquerque, NM and Livermore, CA: Sandia National Laboratories. https://doi.org/10.2172/1665935.
Evans, A., S. Horowitz, R. Whalen, L. Gilbert, and R. Knudsen. 2021b. “DOE ARS—SMR Security by Design and Analysis.” SAND2021-3956 C. Albuquerque, NM: Sandia National Laboratories. https://doi.org/10.2172/1861969.
GAO (Government Accountability Office). 2019. Nuclear Security: The International Atomic Energy Agency Could Improve Priority Setting, Performance Measures, and Funding Stabilization. GAO-19-429. Washington, DC.
Garrett, A.G., S.L. Garrett, R.J. Marek, M.R. Mitchell, C.R. Orton, R.T. Otto, T. Sobolev, and D.C. Springfels. 2021. Advanced Reactor Safeguards: Lessons from the IAEA Safeguards Domain. PNNL-31977. Richland, WA: Pacific Northwest National Laboratory. https://gain.inl.gov/SiteAssets/AdvancedReactorSafeguards/KeyThrustArea5/PNNL-31977_ARS_IAEA_Interfaces.pdf.
Holcomb. D.E., R.A. Kisner, and S.M. Cetiner. 2018. Instrumentation Framework for Molten Salt Reactors. ORNL-TM/2018-868. https://info.ornl.gov/sites/publications/Files/Pub111607.pdf.
Hoyt, N., and C. Moore. 2021. “Flow Enhanced Electrochemical Sensors for Molten Salt Reactors. Argonne National Laboratory.” Presentation. https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Presentations/Safe_Secure_Day3_Website/04-Flow%20Enhanced%20Electrochemical%20Sensors%20for%20MSRs-Hoyt.pdf.
IAEA (International Atomic Energy Agency). 2002. “IAEA Safeguards Glossary: 2001 Edition.” 3. International Nuclear Verification Series. Vienna, Austria. https://www.iaea.org/sites/default/files/iaea_safeguards_glossary.pdf.
IAEA. 2010. The Interface Between Safety and Security at Nuclear Power Plants. INSAG-24. A Report by the International Nuclear Safety Group (INAG). Vienna, Austria.
IAEA. 2014. Use of a Graded Approach in the Application of the Management System Requirements for Facilities and Activities. IAEA-TECDOC-1740. Vienna, Austria.
IAEA. 2015. Security of Nuclear Material in Transport. Report No. 26-G. IAEA Nuclear Security Series. Vienna, Austria.
IAEA. 2016. “Basics of IAEA Safeguards.” https://www.iaea.org/topics/basics-of-iaea-safeguards.
IAEA. 2020. IAEA Nuclear Security Glossary: Terminology Used in IAEA Nuclear Security Guidance. Draft. https://www.iaea.org/sites/default/files/21/06/nuclear_security_glossary_august_2020.pdf.
IAEA. 2022a. Webinar on Safety, Security and Safeguards Interfaces and Challenges for Novel Advanced Reactors. IAEA. February 3. https://www.iaea.org/resources/webinar/webinar-on-safety-security-and-safeguards-interfaces-and-challenges-for-novel-advanced-reactors.
IAEA. 2022b. The Agency’s Budget Update for 2023. GC(66)/6. Vienna, Austria.
Iturria, F.P., and W. Li. 2022. “Time to Act: Integrating Safety, Security and Safeguards in the Design of Innovative Reactors.” International Atomic Energy Agency News, July12. https://www.iaea.org/newscenter/news/time-to-act-integrating-safety-security-and-safeguards-in-the-design-of-innovative-reactors.
Kallenborn, Z., and P.C. Bleek. 2018. “Swarming Destruction: Drone Swarms and Chemical, Biological, Radiological, and Nuclear Weapons.” The Nonproliferation Review 25(5–6):523–543.
Kovacic, D., P. Gibbs, and L. Scott. 2020. Model MC&A Plan for Pebble Bed Reactors. ORNL/SPR-2019/1329. Oak Ridge, TN: Oak Ridge National Laboratory.
Lauren-Kovitz, K. 2021. “Advanced Nuclear Security, Waste and Energy R&D (ANSWER), Progress and Promise.” Presentation to the Committee. https://www.nationalacademies.org/event/10-04-2021/docs/D52630E2987C93A70C05AFBCF7DC862DC356D741B985.
Lines, A.M., H.M. Felmy, A.S. Medina, S.D. Branch, and S.A. Bryan. 2020. Evaluation of Optical Techniques for Molten Salt Reactor Material Control and Accounting. PNNL-30360. Pacific Northwest National Laboratory. https://gain.inl.gov/SiteAssets/2021-April_SafeguardsAndSecurityWorkshop/Reading/Evaluation%20of%20Optical%20Techniques%20for%20Molten%20Salt%20Reactor%20Materials%20Control%20and%20Accounting%20-%20PNNL.pdf.
Liou, J. 2022a. “IAEA Director General Calls for Restraint, Reiterates Need to Ensure Safety of Ukraine’s Nuclear Facilities and Their Staff.” International Atomic Energy Agency, March 2. https://www.iaea.org/newscenter/news/iaea-director-general-calls-for-restraint-reiterates-need-to-ensure-safety-of-ukraines-nuclear-facilities-and-their-staff.
Liou, J. 2022b. “IAEA Initiative Sets Ambitious Goals to Support the Safe and Secure Deployment of SMRs.” International Atomic Energy Agency News, July 4.
Maceda, M.G., E. Krabill, and W. Wan. 2022. “Incorporating New Technologies: Lessons from ‘Special Circumstances.’” Presentation at the First International Conference on Nuclear Law, Plenary Session No. 4, Safeguards: Issues and Trends. International Atomic Energy Agency. April 27.
Martin, K. 1987. “Safeguards Concept for the THTR-300 Thorium High Temperature Reactor.” P. 147 in Nuclear Safeguards Technology 1986: Proceedings of an International Symposium on Nuclear Material Safeguards. Vol. 2. Vienna, Austria: International Atomic Energy Agency.
National Research Council. 2013. Improving the Assessment of the Proliferation Risk of Nuclear Fuel Cycles. Washington, DC: The National Academies Press. https://doi.org/10.17226/18335.
NEI (Nuclear Energy Institute). 2010. Cyber Security Plan for Nuclear Power Reactors. NEI 08-09 [Rev. 6]. Washington, DC.
NEI. 2016. “Cyber Security for Nuclear Power Plants.” https://www.nei.org/resources/reports-briefs/cybersecurity-for-nuclear-power-plants.
NRC (U.S. Nuclear Regulatory Commission). 2010. Nuclear Regulatory Guide 5.71: Cyber Security Programs for Nuclear Facilities. https://www.nrc.gov/docs/ML0903/ML090340159.pdf.
NRC. 2018. “Options and Recommendations for Physical Security for Advanced Reactors.” SECY-18-0076. https://www.nrc.gov/docs/ML1817/ML18170A051.html.
NRC. 2022. “Proposed Rule: Alternative Physical Security Requirements for Advanced Reactors.” SECY-22-0072. https://www.nrc.gov/docs/ML2133/ML21334A003.html.
Office of the Director of National Intelligence. 2022. Annual Threat Assessment of the U.S. Intelligence Community. https://www.dni.gov/files/ODNI/documents/assessments/ATA-2022-Unclassified-Report.pdf.
Prasad, S., A. Abdulla, M.G. Morgan, and I. Azevedo. 2015. “Nonproliferation Improvements and Challenges Presented by Small Modular Reactors.” Progress in Nuclear Energy 80:102–109.
Sanders, K.E., R.B. Pope, Y.Y. Liu, and J.M. Shuler. 2015. Interfaces Among Safety, Security, and Safeguards (3S)—Conflicts and Synergies. INMM 56th Annual Meeting, July 12–16.
Snell, M.K., C.D. Jaeger, C. Scharmer, S.E. Jordan, K. Tanuma, K. Ochiai, et al. 2013. Security by Design Handbook. SAND2012-0038. https://doi.org/10.2172/1088049.
Suzuki, M., Y. Izumi, T. Kimoto, Y. Naoi, T. Inoue, B. Hoffheins. 2010. Investigating 3S Synergies to Support Infrastructure Development and Risk-Informed Methodologies for 3S by Design. IAEA-CN-184/64.
Transportation Emergency Preparedness Program. 2023. “Home.” https://teppinfo.com.
