Integrate fingerprint-based criminal-history checks into nuclear access decisions

Frame this document as a source-led configuration and assurance check: Integrate fingerprint-based criminal-history checks into nuclear access decisions. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official 10 CFR 73.57 – Criminal history records checks from U.S. Nuclear Regulatory Commission via eCFR supports the following bounded statements:

• Under 10 CFR 73, the rule requires that the licensee retain all fingerprint and criminal history records received from the FBI, or a copy if the individual’s file has been transferred, on an individual (including data indicating no record) for one year after termination or denial of unescorted access to the nuclear power facility, the non-power reactor facility, or access to Safeguards Information. The research record locates this support at 10 CFR 73.57(f)(5) (eCFR anchor p-73.57(f)(5)).
• Under 10 CFR 73, except those listed in paragraph (b)(2) of this section, each licensee subject to the provisions of this section must fingerprint each individual who is permitted unescorted access to the nuclear power facility, the non-power reactor facility in accordance with paragraph (g) of this section, or access to Safeguards Information. The research record locates this support at 10 CFR 73.57(b)(1) (eCFR anchor p-73.57(b)(1)).

Only the traced statements above are asserted as source facts. Apply the review to credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces after confirming that the source and deployed context match.

What the source does not establish

NRC regulation with defined covered populations and procedures; privacy, notices, record handling, exceptions, appeals, and other authorization factors require full-rule review. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators are healthy. Documented options are review inputs, not universal mandates.

Applicability questions

• For source statement 1 at 10 CFR 73.57(f)(5) (eCFR anchor p-73.57(f)(5)), which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at 10 CFR 73.57(b)(1) (eCFR anchor p-73.57(b)(1)), which observable configuration, record, or test can confirm applicability here?
• Which owner can attest to the recorded state of credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces, including exceptions?
• What baseline for identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators must accompany the source-specific observation?
• Which success, stop, and escalation criteria are written before testing begins?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Begin by recording scope and current state before deciding whether a change is warranted. Record the source location, examined part of credentials, readers, controllers, panels, door hardware, access decisions, monitoring, and life-safety interfaces, observed and expected states, owner, and reason for deviation.

Translate the conclusion into change control only after documenting dependencies, impact, test method, expected signals, failure signals, and restoration steps. Include identity sources, DNS where used, time, networks, power, fire systems, monitoring, and authorized operators, while excluding secrets and sensitive personal or topology data from ordinary tickets.

Verification and evidence

Tie each conclusion back to 10 CFR 73.57(f)(5) (eCFR anchor p-73.57(f)(5)); 10 CFR 73.57(b)(1) (eCFR anchor p-73.57(b)(1)) and to observable material such as approved configuration exports, access-event tests, controller state, door inspections, alarm handling, and exception records. Preserve provenance and stable identifiers without copying secrets into the evidence set.

Retain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.

Official references

• 10 CFR 73.57 – Criminal history records checks — U.S. Nuclear Regulatory Commission via eCFR