Govern unescorted nuclear-facility access through an authorization program

Treat this document as a focused evidence review: Govern unescorted nuclear-facility access through an authorization program. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official 10 CFR 73.56 – Nuclear power plant personnel access authorization from U.S. Nuclear Regulatory Commission via eCFR supports the following bounded statements:

• Under 10 CFR 73, individuals who are subject to an access authorization program under this section must at a minimum, report any concerns arising from behavioral observation, including, but not limited to, concerns related to any questionable behavior patterns or activities of others to the reviewing official, his or her supervisor, or other management personnel designated in their site procedures. The research record locates this support at 10 CFR 73.56(f)(3) (eCFR anchor p-73.56(f)(3)).
• Under 10 CFR 73, any individual who is applying for unescorted access or unescorted access authorization must disclose the personal history information that is required by the licensee’s or applicant’s access authorization program, including any information that may be necessary for the reviewing official to make a determination of the individual’s trustworthiness and reliability. The research record locates this support at 10 CFR 73.56(d)(2)(i) (eCFR anchor p-73.56(d)(2)(i)).

Only the traced statements above are asserted as source facts. Apply the review to credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces after confirming that the source and deployed context match.

What the source does not establish

NRC regulation for covered access programs; screening, fitness-for-duty, appeals, records, privacy, insider mitigation, and license conditions require complete qualified review. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators are healthy. Documented options are review inputs, not universal mandates.

Applicability questions

• For source statement 1 at 10 CFR 73.56(f)(3) (eCFR anchor p-73.56(f)(3)), which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at 10 CFR 73.56(d)(2)(i) (eCFR anchor p-73.56(d)(2)(i)), which observable configuration, record, or test can confirm applicability here?
• Which owner can attest to the recorded state of credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces, including exceptions?
• What baseline for identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators must accompany the source-specific observation?
• Which success, stop, and escalation criteria are written before testing begins?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Begin by recording scope and current state before deciding whether a change is warranted. Record the source location, examined part of credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces, observed and expected states, owner, and reason for deviation.

If the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators and sanitize protected material before retention.

Verification and evidence

Tie each conclusion back to 10 CFR 73.56(f)(3) (eCFR anchor p-73.56(f)(3)); 10 CFR 73.56(d)(2)(i) (eCFR anchor p-73.56(d)(2)(i)) and to observable material such as approved configuration exports, access-event tests, controller state, door inspections, alarm handling, and exception records. Preserve provenance and stable identifiers without copying secrets into the evidence set.

Keep before-state evidence, approval, test or change result, exceptions, and after-state evidence together. Use an approved lab, window, or nonproduction path for risky tests. Set a recheck trigger for version, architecture, dependency, vendor, incident, or ownership change. A check proves only what was observed.

Official references

• 10 CFR 73.56 – Nuclear power plant personnel access authorization — U.S. Nuclear Regulatory Commission via eCFR