Verifying Operational Effectiveness of Nuclear Security Systems

Nuclear security systems are designed and implemented to prevent malicious acts involving nuclear and other radioactive material. As the hardware and software associated with these systems evolve, they have become heavily reliant upon digital based protocols, data processing, and data transmissions. The integration of digital technologies have increased system effectiveness as well as improved cost efficiency. However, the integration of these new technologies have changed the risk profile of these security systems. Further, the threat environment is evolving and now include technical capabilities that could potentially be used to compromise and manipulate how these systems function. The need for the Competent Authority and other participants in the threat assessment process to consider cyber capabilities for both insider and outsider threats is so important that it is distinctly identified in NSS-10, Development, Use and Maintenance of the Design Basis Threat. As part of the licensing and evaluation process, security professionals must demonstrate the effectiveness of the protection system to protect against a variety of malicious threats. To accomplish this, gaps between physical and cyber elements and how these elements may be susceptible to external or internal exploits must be identified so that mitigation measures can be instituted. Gaps in either cyber or physical, resulting in risk to nuclear security can be classified into one or more of the following areas: • Physical exposure; • Persistent vulnerabilities; • Lack of skill and awareness; and • Division of responsibilities. Nuclear facilities in the process of retrofitting their systems from analog to digital technologies, comprehensive site assessment testing potentially addresses both physical and cyber concerns. Site acceptance testing is the inspection, dynamic testing, and qualification of systems or major system components verifying that the equipment or system meets or exceeds predefined operational requirements. A site acceptance test is an important step in the lifecycle of a nuclear security system and provides a systematic and holistic evaluation of the performance of the system. Threats to nuclear security systems come from numerous sources, including hostile governments, terrorist groups, disgruntled employees, and malicious intruders. Using a formal site acceptance testing for new or upgraded nuclear security systems provides process-related risk reduction against the evolving threat. This paper addresses four areas of risk to a nuclear security system and describes how a site acceptance test conducted prior to commissioning a nuclear security system ensures a systematic evaluation of the security system against physical and cyber threats. (author)