10 CFR 73 SGI, Reg Analysis

Draft Revised Regulatory Analysis for the Final Rule Pertaining to the Protection of Safeguards Information (10 CFR Part 73)

U.S. Nuclear Regulatory Commission

August 2007

EXECUTIVE SUMMARY

In response to the September 11, 2001, terrorist attacks on the World Trade Center in New York, NY, and the Pentagon in Arlington, VA, the U.S. Nuclear Regulatory Commission (Commission, NRC) conducted a review of its safeguards and security programs and requirements. From this review and a review of information from the intelligence community, the Commission issued orders relating to the designation and handling of Safeguards Information (SGI).

This final rule reflects the Commission’s practices set forth in those previously issued orders and advisories. It also reflects: 1) the Commission’s comprehensive review of security policies and requirements, 2) the statutory requirements in Section 652 of the Energy Policy Act of 2005 that require fingerprinting, for criminal history records check purposes, of a broader class of persons than was previously required under the Atomic Energy Act, 3) public comments on the proposed rule received prior to passage of the Energy Policy Act of 2005, 4) public comments on the revised proposed rule, and 5) Commission directions to the staff.

The requirements imposed by the orders have added licensees, information, and materials which are not covered by the current regulations, but which are within the scope of the AEA. In addition, the orders added a new designation “Safeguards Information-Modified Handling (SGI-M)” for Safeguards Information subject to modified handling, which is included in the final rule.

The purpose of this regulatory analysis is to measure the incremental costs of the Rule. The baseline for the analysis is the no action alternative, or how things would be without the Rule. In the absence of the Rule, the Commission’s orders would remain in place. The costs and benefits evaluated in the regulatory analysis are only those costs and benefits that would occur under the final rule, excluding costs and benefits associated with the Commission SGI protection orders or the current § 73.21 regulations. There are no quantitative benefits associated with the rule in this analysis. The qualitative benefits include the reduced risk of effects on public and occupational health and on property damage that are associated with a security-related event; an increase in the common defense and security; and enhanced regulatory efficiency. The quantitative costs include NRC and Agreement State licensee implementation and annual operation costs, and NRC annual operation costs associated with the rule. These costs range from approximately $9.1 million at a 7 percent discount rate to approximately $10.9 million at a 3 percent discount rate in 2007 dollars.

Another analysis called the pre-order analysis is included in this regulatory analysis for informational purposes only. Under this analysis, the costs and benefits associated with the Rule are evaluated relative to a baseline before any Commission orders relating to SGI were issued. There are no quantitative benefits associated with the rule in this analysis. The qualitative benefits include the reduced risk of effects on public and occupational health and on property damage that are associated with a security-related event; an increase in the common defense and security; and enhanced regulatory efficiency. The quantitative costs include implementation and annual operation costs associated with the rule for the NRC, NRC and Agreement State licensees and applicants, and state governments. These costs range from approximately $15.8 million at a 7 percent discount rate to approximately $18.8 million at a 3 percent discount rate in 2007 dollars.

Although significant costs are incurred as a result of the Rule, the qualitative benefits associated with the rule outweigh its costs. The final rule is the preferred alternative.

No backfit analysis was conducted for this rule. As stated in the “Backfit Analysis” section in this Regulatory Analysis and in the Federal Register notice for the final rule, any requirements in the rule that constitute backfits are necessary to ensure that the facilities and materials described in the rule provide adequate protection to the public health and safety and are in accord with the common defense and security, as applicable. Therefore, a backfit analysis is not required and the cost-benefit standards of 10 CFR 50.109(a)(3), 70.76, 72.62, and 76.76, do not apply.

TABLE OF CONTENTS

1. Introduction 1

1.1 Background 1

1.2 Objectives of the Regulatory Action 2

2. Identification of Regulatory Alternatives 3

2.1 No Action Alternative 3

2.2 Final Rule Alternative 3

3. Analysis of Values and Impacts 8

3.1 Main Analysis 8

3.1.1 Baseline for the Main Analysis 8

3.1.2 Identification of Affected Attributes in the Main Analysis 9

3.1.3 Methodology of the Main Analysis 10

3.1.4 Affected Universe of the Main Analysis 10

3.1.5 Analysis of Values in the Main Analysis 11

3.1.6 Analysis of Impacts in the Main Analysis 11

3.1.7 Results of the Main Analysis 13

3.1.8 Preferred Alternative 14

3.2 Pre-Order Analysis 22

3.2.1 Baseline for the Pre-Order Analysis 22

3.2.2 Identification of Affected Attributes in the Pre-Order Analysis 22

3.2.3 Methodology of the Pre-Order Analysis 23

3.2.4 Affected Universe of the Pre-Order Analysis 23

3.2.5 Analysis of Values in the Pre-Order Analysis 24

3.2.6 Analysis of Impacts in the Pre-Order Analysis 24

3.2.7 Results of the Pre-Order Analysis 27

4. Backfit Analysis 36

5. Decision Rationale 36

6. Implementation 36

Appendix A - Regulatory Flexibility Act Considerations

1. Introduction

The Nuclear Regulatory Commission (NRC) is amending its regulations pertaining to the protection of Safeguards Information (SGI) to reflect Commission practices set forth in previously issued orders and advisories, the results of the Commission’s comprehensive review of security policies and requirements, the fingerprinting requirements in the Energy Policy Act of 2005 (2005 EPAct), comments received on the proposed rule prior to passage of the 2005 EPAct, public comments on the revised proposed rule, and Commission directions to the NRC staff. This regulatory analysis (RA) is part of the Commission’s analysis of the options being considered and is a supporting document for the final rule. The purpose of this RA is to evaluate the costs and benefits associated with the regulatory changes being imposed by the Commission. The NRC considers the regulatory analysis process an integral part of its statutory mission to ensure reasonable assurance for the protection of public health and safety, property, environmental quality, and common defense and security from civilian uses of nuclear materials. This document presents background material, describes the objectives of the Rule, outlines the alternatives being considered, and evaluates the values and impacts of the regulatory alternatives.

1.1 Background

In response to the September 11, 2001, terrorist attacks on the World Trade Center in New York, NY, and the Pentagon in Arlington, VA, the Commission conducted a review of its safeguards and security programs and requirements. As a result of this review as well as a review of information provided by the intelligence community, the Commission issued orders relating to the designation and handling of SGI.

SGI is a special category of sensitive unclassified information authorized by Section 147 of the Atomic Energy Act, as amended (AEA), to be protected from unauthorized disclosure. Although SGI is considered to be sensitive unclassified information, it is handled and protected more like classified National Security information than like other sensitive unclassified information (e.g., privacy and proprietary information). Part 73, “Physical Protection of Plants and Materials,” of the Commission’s regulations in Title 10 of the Code of Federal Regulations contains requirements for the protection of SGI. Commission orders issued since September 11, 2001 have also imposed requirements for the designation and protection of SGI. These requirements apply to SGI in the hands of any person, whether or not a licensee of the Commission, who produces, receives, or acquires SGI. An individual’s access to SGI is controlled by a valid “need to know” for such information, a criminal history records check (which includes fingerprinting), and a background check to determine trustworthiness and reliability. Power reactors, research and test reactors with a formula quantity of strategic special nuclear material, and spent fuel storage installations are the primary categories of licensees within the scope of the provisions of Part 73 for the protection of SGI. Examples of the types of information designated as SGI include the physical security plan for a facility possessing special nuclear material; the design features of such a licensee’s physical protection system; and operational procedures for the licensee’s security organization.

The Commission has authority under Section 147 of the Act to designate, by regulation or order, other types of information as SGI. For example, Section 147.a.(2) allows the Commission to designate a licensee’s or applicant’s detailed security measures (including security plans, procedures and equipment) for the physical protection of source material or byproduct material in quantities determined by the Commission to be significant to the public health and safety or the common defense and security. Therefore, the Commission has, by order, imposed SGI handling requirements on licensees not subject to the current requirements in 10 CFR Part 73. An example of this type of order is the November 25, 2003, order to all licensees authorized to manufacture or initially transfer items containing radioactive material for sale or distribution and who possess certain radioactive material of concern and persons who obtain SGI described in those orders. (January 23, 2004; 69 FR 3397).

The Commission has authority under Section 149 of the AEA, as amended by the 2005 EPAct, to require that individuals to be granted unescorted access to nuclear power facilities or access to SGI, including SGI-M, undergo a Federal Bureau of Investigation (FBI) criminal history records check before such access. Before the 2005 EPAct, only licensees or applicants for a license to operate a utilization facility were required to fingerprint each individual permitted unescorted access to the facility or access to Safeguards Information. Under Section 149, as amended by the 2005 EPAct, the following individuals or entities are now required to fingerprint any individual considered for access to SGI: 1) individuals licensed or certified to engage in an activity subject to regulation by the Commission, including utilization facilities; 2) individuals who have filed an application for a license or certificate to engage in Commission-regulated activities; and 3) individuals who have notified the Commission in writing of an intent to file an application for licensing, certification, permitting, or approval of a product or activity subject to regulation by the Commission.

Violations of SGI handling requirements, whether those specified in Part 73 or those imposed by order, are equally subject to the applicable civil and criminal sanctions. Employees, past or present, and all persons who have had access to SGI have a continuing obligation to protect it in order to prevent inadvertent release and unauthorized disclosure. Information designated as SGI must be withheld from public disclosure and must be physically controlled and protected. Physical protection requirements include (1) secure storage, (2) document marking, (3) access restrictions to authorized individuals who have been fingerprinted, (4) limited reproduction, (5) protected transmission, and (6) controls for information processing on electronic systems.

1.2 Objectives of the Regulatory Action

Changes in the threat environment since September 11, 2001, have revealed the need to protect additional types of security information held by a broader group of licensees as SGI. Under the current regulations, some licensees are not required to operate a SGI protection program. Other licensees, who already maintain a SGI protection program, are not required, under the current regulations, to protect certain types of information vital to the common defense and security. The unauthorized release of this information could result in harm to the public health and safety and the Nation’s common defense and security, as well as damage to the Nation’s critical infrastructure, including nuclear power plants and other facilities and materials licensed and regulated by the NRC.

The Commission has issued orders that have increased the number of licensees whose security measures will be protected as SGI and which have added additional types of security information considered to be SGI. Some of the orders expanded the types of information to be protected by licensees who already have an SGI protection program. Other orders were issued to licensees that have not previously been subject to SGI requirements, and certain orders imposed a new designation: Safeguards Information-Modified Handling (SGI-M). SGI-M pertains to certain SGI subject to handling requirements that are modified from those for other SGI requirements. An objective of the Commission’s orders and the final rule is to improve safeguards and security.

Although new SGI requirements could continue to be imposed via issuance of orders, the regulations would not reflect current Commission SGI policy and/or requirements. Also, the orders apply only to the licensees named in the orders. Such enforcement orders do not apply prospectively to applicants for new licenses as the final rule would. And unlike a rule, orders remain in effect only “until the Commission determines otherwise.” Finally, in order to improve regulatory efficiency, it has been Commission policy to implement generally applicable requirements in the regulations and not to rely on orders indefinitely to impose necessary generic requirements.

2. Identification of Regulatory Alternatives

This regulatory analysis evaluates the values and impacts of two regulatory alternatives. The following subsections describe these two alternatives.

2.1 No Action Alternative

The no action alternative is how the world would look absent the final rule. Under the no action alternative, the NRC would not implement the Rule. The current regulations and the Commission orders described above would remain in place. The no action alternative serves as the baseline against which the final rule alternative (described below) is measured.

2.2 Final Rule Alternative

Under the final rule alternative, the NRC would revise its regulations for the protection of SGI in 10 CFR Part 73 to reflect Commission practices set forth in previously issued orders and advisories; the results of the Commission’s comprehensive review of security policies and requirements; the fingerprinting requirements in 2005 EPAct; public comments received in this rulemaking prior to passage of the 2005 EPAct; public comments on the revised proposed rule; and Commission directions to the staff. The requirements have added licensees, information, and materials that are not covered by the current regulations, but are within the scope of the AEA. In addition, the orders adding a new designation, SGI-M are included in the final rule. The following is a summary of the rule.

1. Implement expanded fingerprinting and criminal history records check procedures required by Section 652 EPAct of 2005.

2. Types of Information to be Protected. The types of information and documents that must be protected as SGI or SGI-M include non-public security-related requirements such as protective measures, interim compensatory measures, additional security measures, and the following, as applicable:

1. Physical Protection at Fixed Sites. Information not classified as Restricted Data or National Security Information related to physical protection, including:

1. The composite physical security plan for the facility or site;

2. Site-specific drawings, diagrams, sketches, or maps that substantially represent the final design features of the physical security system not easily discernable by members of the public;

3. Alarm system layouts;

4. Physical security orders and procedures for members of the security organization detailing duress codes, patrol routes and schedules, or responses to security contingency events;

5. Site-specific design features of plant security communications systems;

6. Lock combinations, mechanical key designs, or passwords integral to the physical security system;

vii. Documents and other matter that contain lists or locations of certain safety-related equipment identified as vital for purposes of physical protection (§ 73.22 only);

viii. Composite safeguards contingency plan/measures for the facility or site (§ 73.22 only);

ix. Composite facility guard qualification and training plan/measures disclosing features of the physical security system or response procedures;

x. Information relating to onsite or offsite response forces, including size, armament of response forces, and arrival times of such forces committed to respond to security contingency events;

xi. The adversary characteristics document, and related info, including implementing guidance associated with the Design Basis Threat in § 73.1 (§ 73.22 only);

xii. Engineering and safety analyses, security-related procedures or scenarios, and other information revealing site-specific details of the facility or materials if the unauthorized disclosure of such information could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by significantly increasing the likelihood of theft, diversion, or sabotage of source, byproduct, or special nuclear material; and

xiii. Descriptions of security activities which disclose features of the physical security system or response measures (§ 73.23 only).

2. Physical Protection in Transit.

1. Composite physical security plan for transportation (§ 73.22) or information regarding transportation security measures, including physical security plans and procedures more detailed than NRC regulations (§ 73.23);

2. Schedules and itineraries for specific shipments as defined in the final rule (§ 73.22 only) ;

iii. Vehicle immobilization features, intrusion alarm devices, and communication systems (§ 73.22 only);

iv. Arrangements with and capabilities of local police response forces and locations of safe havens identified along the transportation route;

v. Limitations of communications during transport (§ 73.22); Details of alarm and communication systems, communication procedures and duress codes (§ 73.23);

vi. Procedures for response to security contingency events;

vii. Information concerning the tactics and capabilities required to defend against attempted radiological sabotage, or theft and diversion of formula quantities of special nuclear material, irradiated reactor fuel, or related information (§ 73.22 only); and

viii. Engineering and safety analyses, security-related procedures or scenarios, and other information related to the protection of the transported materials if the unauthorized disclosure could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by significantly increasing the likelihood of theft, diversion or sabotage.

3. Inspections, Audits, and Evaluations. Portions of inspection reports, evaluations, audits, or investigations that contain details of a licensee’s or applicant’s physical security system or that disclose uncorrected defects, weaknesses, or vulnerabilities in the system.

4. Correspondence. Portions of correspondence that contain SGI or SGI-M.

3. Conditions for Access to SGI or SGI-M. Anyone with access to SGI or SGI-M must have a “need to know” for the information and meet the following conditions:

1. Undergo an FBI criminal history records check, including fingerprinting; and

2. Undergo a background check to determine trustworthiness and reliability.

3. The following individuals are exempt from the criminal history records check and background check requirements

1. An employee of the Commission or the Executive Branch of the United States government who has undergone fingerprinting for a prior U.S. government criminal history records check;

2. A member of Congress;

3. An employee of a member of Congress or Congressional Committee who has undergone fingerprinting for a prior U.S. government criminal history records check;

4. The Comptroller General or an employee of the Government Accountability Office who has undergone fingerprinting for a prior U. S. Government criminal history records check;

5. The Governor of a State or his or her designated State employee representative;

6. A representative of a foreign government organization that is involved in planning for, or responding to, nuclear or radiological emergencies or security incidents who the Commission approves for access to SGI, including SGI designated as SGI-M;

7. Federal, State or local law enforcement personnel;

8. State Radiation Control Program Directors and State Homeland Security Advisors or their designated State employee representatives;

9. Agreement State employees conducting security inspections on behalf of the NRC pursuant to an agreement executed under section 274.i. of the AEA;

10. Representatives of the International Atomic Energy Agency (IAEA) engaged in activities associated with the U.S./IAEA Safeguards Agreement who have been certified by the NRC;

11. Any agent, contractor, or consultant of the aforementioned persons who has undergone equivalent criminal history records and background checks to those required by §§ 73.22(b) or 73.23(b).

4. For persons participating in NRC adjudicatory proceedings, the need to know determination shall be made by the originator of the SGI upon receipt of a request for access to the SGI. Disputes over the need to know determination shall be raised before the presiding officer of the proceeding in which the SGI is sought, who shall resolve the dispute.

4. Protection of SGI and SGI-M While in Use or Storage. While in use, SGI and SGI-M must be under the control of an individual authorized access to SGI and SGI-M. While SGI is unattended it must be stored in a locked security storage container (e.g. a safe). While SGI-M is unattended it must be stored in a locked file drawer or cabinet.

5. Preparation and Marking of Documents or Other Matter. Each document or other matter that contains SGI or SGI-M must be marked to indicate the presence of such information in a conspicuous manner at the top and bottom of each page. At a minimum, SGI or SGI-M documents or other matter must be marked “Safeguards Information” or “Safeguards Information–Modified Handling,” as applicable. The first page of each document must also be marked with the name, title, and organization of the individual authorized to make the determination that the document contains SGI or SGI-M; the name of the person who has determined that the document contains SGI or SGI-M; the date the determination was made; and that unauthorized disclosure of the SGI or SGI-M contained in the document would be subject to civil and criminal sanctions. Transmittal letters or memoranda which do not in themselves contain SGI or SGI-M must be marked to indicate that the attachments or enclosures contain SGI or SGI-M but that the transmittal does not. Transmittal documents for correspondence with the NRC containing both SGI and non-safeguards information or SGI-M and non-SGI-M must be “portion marked” to identify those sections which contain SGI or SGI-M and those that do not.

6. Reproduction of SGI or SGI-M. SGI and SGI-M may be reproduced to the minimum extent necessary. Equipment used to reproduce SGI or SGI-M must be evaluated to ensure unauthorized individuals cannot access SGI or SGI-M.

7. External transmission of SGI or SGI-M Documents and Material. When transmitting SGI or SGI-M outside an authorized place of use or storage, it must be packaged in two sealed envelopes or wrappers. The outer envelope or wrapper must be opaque and must not have any markings that would disclose the presence of its SGI or SGI-M contents. The inner envelope or wrapper must include the name and address of the intended recipient and be marked on both sides, top and bottom, with the words “Safeguards Information” or “Safeguards Information–Modified Handling,” as applicable. SGI or SGI-M may be transported by any commercial delivery company that provides service with computer tracking features, U.S. first class, registered, express, or certified mail, or by any individual authorized access pursuant to these requirements. Except under emergency or extraordinary conditions, SGI or SGI-M shall be transmitted electronically only when using protected telecommunications circuits (including facsimiles) or by an approved encryption method.

8. Processing of SGI or SGI-M on Electronic Systems.

A. Section 73.22. SGI protected under Section 73.22 may be stored, processed, or produced on a stand-alone computer or computer system for processing SGI to which access is limited to individuals authorized to access SGI. This computer or computer system may not in any way be connected to a network accessible by users who are not authorized to access SGI. A computer used to process SGI not located within an approved and lockable security storage container must have a removable storage medium with a bootable operating system which must be used to load and initialize the computer. The removable storage medium must also contain the software application programs. Data may be saved on either the removable storage medium that is used to boot the operating system, or on a different removable storage medium. The removable storage medium must be secured in a locked security storage container when not in use. A mobile device such as a laptop computer may be used to process SGI provided that it is locked in a security storage container when not in use.

B. Section 73.23. SGI-M protected under Section 73.23 may be stored, processed, or produced on a computer or computer system assigned to a licensee’s or contractor’s facility. SGI-M files must be protected, either by password or encryption, to prevent unauthorized individuals from gaining access. A mobile device such as a laptop computer may be used to process SGI-M provided that it is stored in an appropriate locked storage container when not in use.

9. Removal from SGI or SGI-M Category. Documents originally containing SGI or SGI-M must be removed from the SGI or SGI-M category when it is determined that the information in the document is no longer SGI or SGI-M. The authority to make such a determination may be made by the NRC, with the approval of the NRC, or in consultation with the individual or organization that made the original determination.

10. Destruction of SGI or SGI-M Documents and Other Material. Documents or other material containing SGI or SGI-M must be destroyed when no longer needed. The information can be destroyed by burning, shredding or any other method that precludes reconstruction of the material. Piece sizes no wider than one-quarter inch composed of several pages or documents and thoroughly mixed are considered completely destroyed.

3. Analysis of Values and Impacts

The two subsections below describe the analysis conducted to identify and evaluate the values and impacts resulting from the final rule. The main analysis is presented in Subsection 3.1. A second analysis called the pre-order analysis is presented in Subsection 3.2.

3.1 Main Analysis

The main analysis measures the incremental values and impacts of the final rule alternative relative to the no action alternative, which is the status quo in the absence of the final rule.

3.1.1 Baseline for the Main Analysis

The baseline used in the main analysis is the no action alternative, which is how the world would be absent the final rule. This baseline assumes full compliance with existing NRC requirements, including current regulations and orders. This is consistent with

NUREG/BR-0058, “Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission,” Rev. 4, which states that, “in evaluating a new requirement..., the staff should assume that all existing NRC and Agreement State requirements have been implemented.” Because SGI protection orders have been regularly issued, even after the publication of the revised proposed rule, the baseline for the main analysis has been continually changing, which results in different cost amounts in the main analysis.

3.1.2 Identification of Affected Attributes of the Main Analysis

The attributes that the final rule could affect were identified using the list of potential attributes provided in Chapter 5 of NUREG/BR-0184, “Regulatory Analysis Technical Evaluation Handbook.” Each attribute listed in Chapter 5 was evaluated. The attributes that could be affected by the final rule are listed below.

• Public and Occupational Health (Accident/Event). The final rule requires more information to be protected as SGI or SGI-M. This could have a positive effect on public and occupational health because it decreases security threats associated with the disclosure of SGI or SGI-M.

• Offsite Property. The final rule could decrease the risk of offsite property damage and costs (e.g., emergency response) that could follow a terrorist attack or other security-related event associated with the disclosure of SGI or SGI-M.

• Onsite Property. Implementation of the final rule could decrease the risk of onsite property damage and costs (e.g., cleanup and decontamination).

• Industry Implementation. Those engaged in an activity subject to regulation by the Commission, applicants to engage in such activities, and individuals who have notified the Commission in writing of an intent to file an application for licensing, certification, permitting, or approval of a product or activity subject to regulation by the Commission would incur costs to implement the final rule. The final rule increases the number of licensees required to protect SGI. In addition, licensees that already protect SGI under the current § 73.21 may have to modify their SGI protection program to meet the requirements of the final rule. Licensees other than power reactors would have to perform background checks, including fingerprinting, to grant access to SGI (although some of these requirements have been imposed by order). Power reactors are already required to perform FBI criminal history records checks under § 73.21(c)(i).

• Industry Operation. For entities that have not been required to protect SGI under current regulations and orders, implementation of the final rule would increase operation costs (e.g., training of new employees and marking SGI). Those entities that already protect SGI would incur incremental costs as a result of the final rule because the amount of SGI to be protected would increase under the final rule.

• NRC Operation. NRC would incur the costs of performing the background checks and obtaining the FBI criminal history records checks as required in 10 CFR 2.336(f), 2.705(c), 2.709(f), and 2.1010(b)(6) of the final rule. The NRC would also incur costs related to implementing the new rule through regulatory guidance preparation, training, and advice.

• Regulatory Efficiency. The final rule would enhance regulatory efficiency by implementing generally applicable requirements similar to the Commission-issued SGI and SGI-M orders for current licensees, future applicants, and others.

• Safeguard and Security Considerations. The final rule would increase the level of protection of SGI, and thereby increase the common defense and security of the nation.

Relative to the main analysis baseline, the final rule would not be expected to affect the following attributes:

• Public Health (Routine)

• Occupational Health (Routine)

• NRC Implementation

• Other Government

• General Public

• Improvements in Knowledge

• Environmental Considerations

3.1.3 Methodology of the Main Analysis

This subsection describes the methodology used to analyze the incremental values and impacts associated with the final rule relative to the baseline described in section 3.1.1 above. The values (savings) include any desirable changes in the affected attributes, while the impacts (costs) include any undesirable changes in the affected attributes. This analysis relies on both quantitative and qualitative analyses of the affected attributes. The quantitative analysis involves the assessment of costs and savings associated with the final rule. The qualitative analysis involves a discussion of those attributes that the NRC was not able to quantify.

In accordance with Office of Management and Budget guidance and NUREG/BR0058, Rev. 4, the results of the analysis are presented using both 3 percent and 7 percent real discount rates.

3.1.4 Affected Universe of the Main Analysis

The entities that would be affected by the final rule relative to the main baseline are shown in Table 1 below. (Please note that the word “entity” is meant to include NRC and Agreement State licensees as well as others affected by the final rule.) Some of the licensees included in the table have been issued SGI protection orders by the Commission, while other licensees protected SGI under the current regulations at § 73.21 (the power reactors, 8 of the research and test reactors, and the independent spent fuel storage installations). The licensees currently protecting SGI under § 73.21 or under Commission orders would incur additional costs associated with the final rule because the rule expands the information to be protected, requires trustworthiness and reliability determinations for the research and test reactors currently subject to § 73.21, expands the scope of individuals subject to criminal history records checks including fingerprinting, and changes the SGI marking requirements.

3.1.5 Analysis of Values in the Main Analysis

There are no quantifiable values (i.e. benefits) associated with the final rule. The qualitative values of the final rule are associated with safeguard and security considerations or the decreased risk of a security-related event, such as an act of sabotage or a terrorist attack. Increasing the security of SGI and SGI-M decreases this risk and increases the common defense and security of the nation. Other qualitative values that are positively affected by the decreased risk of a security-related event include public and occupational health due to an accident or event and the risk of damage to onsite and offsite property. In addition, regulatory efficiency is enhanced by the final rule.

3.1.6 Analysis of Impacts in the Main Analysis

The assumptions used in analyzing the quantifiable impacts (costs) associated with the final rule are discussed in this subsection. These costs are associated with the entities identified in Table 1 that would be required to protect SGI and SGI-M under the final rule. The hourly rate applied to labor hours is $107 per hour. This is NRC’s 2006 incremental labor rate which includes only those variable costs associated with implementation and operation costs of the final rule. Use of this labor rate is consistent with Section 5.2 of NUREG/CR–4627, Generic Cost Estimates. It is assumed that licensees, applicants, and state contacts have a similar labor rate.

3.1.6.1 Licensee, Holders of CoC’s Pursuant to 10 CFR Part 71, and Applicant Costs

1. Implementation Costs. Under the final rule, the licensees, including holders of certificates of compliance (CoCs) pursuant to the Commission’s regulations at 10 CFR Part 71, as well as applicants to engage in Commission-regulated activities and applicants for Part 71 CoCs. The entities identified in Table 1 would be required to establish a program to designate and protect SGI or SGI-M or to modify an existing SGI program. For the purposes of this analysis, it is assumed that the implementation costs for the licensees and the holders of CoCs pursuant to 10 CFR Part 71, including the labor and other costs discussed below, are incurred in 2008. Because there are new applicants subject to § 73.23 every year, implementation costs for these applicants are calculated every year for 10 years beginning in 2008. The estimated present value of total implementation costs in 2007 dollars (see Tables 2 and 3) at a 7 percent discount rate is $5.8 million. The estimated present value of these costs in 2007 dollars at a 3 percent discount rate is $6.0 million.

A. Labor Costs. Implementation costs include planning, establishing, and documenting a SGI or SGI-M program; initial marking of SGI or SGI-M documents; determining personnel access to SGI or SGI-M (making need to know determinations and performing background checks to determine trustworthiness and reliability, and to collect fingerprints); and training personnel to designate and protect SGI or SGI-M. Based on licensee and NRC staff estimates of these costs, the present value of the labor costs associated with licensee and applicant implementation of the SGI and SGI-M requirements in the final rule relative to the main baseline is approximately $5.6 million at a 7 percent discount rate and $5.8 million at a 3 percent discount rate.

B. Equipment and Other Costs. Implementation costs also include the equipment required to process, mark, and store SGI or SGI-M as required in the final rule. Examples of required equipment include document marking stamps and a safe (for entities protecting SGI) or a locking file cabinet (for entities protecting SGI-M). Another cost associated with the final SGI and SGI-M requirements would be the cost of background checks for many of the licensees. The licensee labor costs associated with gathering data for the background check are included in the labor costs above. Most licensees would then pay for an outside vendor to run a background check. This fee is included as an “other cost” in Table 1. It is estimated that the total cost for equipment and other costs to implement the final rule would be $0.2 million at a 7 percent discount rate and $0.2 million at a 3 percent discount rate. For the purposes of this regulatory analysis, it is assumed that licensees would not have to acquire office space for the additional equipment required to protect SGI.

2. Annual Operation Costs. After establishing or modifying an SGI or SGI-M program, annual operation costs would be incurred by NRC and Agreement State licensees and applicants and holders of CoCs pursuant to 10 CFR Part 71 and applicants. The estimated licensee and applicant annual operation costs, including the labor and other costs discussed below, is $3.0 million at a 7 percent discount rate and $4.6 million at a 3 percent discount rate (see Tables 2 and 3). For power reactors, annual costs were calculated over 33 years of remaining plant life beginning in 2008. The plant life was calculated assuming 100 percent of power reactor licenses will be renewed for one 20-year renewal period. For power reactor applicants, annual costs were calculated over a 40 year period, the term of a power reactor operating license. Annual costs for all other licensees were calculated for 10 years beginning in 2008 based on the assumption that there is an average of 10 years left on their current license.

A. Labor Costs. The annual operation costs associated with an SGI program include designating and protecting new SGI, training new personnel, and collecting fingerprints (for criminal history records checks) and other information (for background checks) from new personnel. The present value of operation costs in 2007 dollars at a discount rate of 7 percent is approximately $2.9 million. At a 3 percent discount rate, the present value of operation costs in 2007 dollars is approximately $4.4 million.

B. Other Costs. In addition to the labor associated with FBI criminal history records checks and background checks included in A. above, licensees would incur fees associated with having a vendor run background checks and the FBI run criminal history records checks on new employees. The present value of these costs in 2007 dollars at a discount rate of 7 percent is approximately $0.1 million. At a 3 percent discount rate, the present value of these costs in 2007 dollars is approximately $0.1 million.

3.1.6.2 NRC Costs

The NRC has incurred or would have incurred implementation and annual operations costs associated with the SGI protection requirements in the current § 73.21 and the Commission’s SGI protection orders. If these costs would have been incurred in the absence of the final rule, they are not included as costs associated with the final rule in the main analysis. One NRC cost that is associated with the final rule is the cost of performing the background checks and obtaining the FBI criminal history records checks as required by §§ 2.336(f), 2.705(c)(2), 2.709(f), and 2.1010(b)(6) of the final rule. The NRC estimates that it would need to perform background checks and obtain FBI criminal history records checks for 25 individuals per year.

The NRC also would incur implementation costs to train the NRC staff and those affected by the rule, and would be providing advice to those requesting assistance in implementing the requirements of the rule. Finally, the NRC would incur costs associated with writing and updating regulatory guidance documents for the rule.

Over 10 years, the 2007 present value the annual operation cost at a discount rate of 7 percent is approximately $31.4 thousand. Labor costs account for $18.8 thousand of this amount. At a discount rate of 3 percent, the cost is approximately $38.2 thousand over the same time period. Labor costs account for $22.8 thousand of this amount.

The NRC’s implementation cost is estimated to be $290.9 thousand at a discount rate of 7% and $280.0 thousand at a discount rate of 3%. The entire implementation cost is due to labor cost.

3.1.6.3 State Government Costs

State transportation contacts protected SGI prior to the final rule and prior to the Commission issuing SGI protection orders. Other state government contacts implemented SGI or SGI-M programs when their licensees received orders. Because these costs would have been incurred in the absence of the final rule, they are not included as costs associated with the final rule in the main analysis.

3.1.7 Results of the Main Analysis

1. Implementation Costs. The total implementation costs associated with the final rule relative to the main baseline are estimated to be $6.0 million at a 7 percent discount rate and $6.3 million at a 3 percent discount rate in 2007 dollars. Of the $6.0 million amount, labor costs account for $5.8 million and other costs such as equipment and background checks account for $0.2 million. Of the $6.4 million amount, labor costs account for $6.1 million and other costs such as equipment and background checks account for $0.2 million. Tables 2 and 3 provide a summary of the implementation costs associated with the final rule in the main analysis.

2. Annual Operation Costs. The total annual operation costs associated with the final rule relative to the main baseline at a 7 percent discount rate are estimated to be $3.0 million in 2007 dollars. Of this amount, labor costs account for $2.9 million and the other costs account for $0.1 million. At a 3 percent discount rate the total estimated annual operation costs of the final rule are $4.4 million in 2007 dollars. Of this amount, labor costs account for $4.3 million while other costs account for $0.1 million. Tables 2 and 3 provide a summary of the annual operation costs associated with the final rule in the main analysis.

As shown in Table 2, the total cost of the final rule relative to the main baseline at a 7 percent discount rate is estimated to be approximately $9.1 million. At a 3 percent discount rate, the total cost of the final rule is estimated to be approximately $10.9 million (see Table 3). Although there are no quantitative benefits under the final rule alternative, there are significant qualitative benefits of the final rule relative to the main baseline. These qualitative values include (1) a positive effect on public and occupational health, (2) increased protection of onsite and offsite property, (3) increased protection of the common defense and security, and (4) enhanced regulatory efficiency.

3.1.8 Preferred Alternative

The final rule alternative is the preferred alternative. Although significant costs are incurred as a result of the final rule, the qualitative benefits associated with the rule outweigh its costs.

Table 1

Main Analysis Data

(Cost Data in 2007 Dollars in Thousands) ^1/

		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 6/ 7/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Power Reactor Sites 8/
Modifying SGI Program	64	0	$0	0	$0	$64.0	$0
Training Staff	64	526	$3,602.0	0	$0	$0	$0
Marking SGI	64	25	$171.2	17.5	$119.8	$16.0	$0
Research and Test Reactors 8/
Modifying SGI Program (§ 73.22)	8	0	$0	0	$0	$4.0	$0
Modifying SGI Program (§ 73.23)	42	0	$0	0	$0	$10.5	$0
Background Checks (not including criminal history records checks based on fingerprinting)	50	18.8	$100.3	3.8	$20.1	$56.3	$11.3
Training Staff (§ 73.22)	8	116	$99.3	0	$0	$0	$0
Training Staff (§ 73.23)	42	116	$521.3	12	$53.9	$0	$0
Marking SGI (§ 73.22)	8	6.3	$5.4	1.3	$1.1	$0.4	$0
Marking SGI (§ 73.23)	42	6.3	$28.1	2.5	$11.2	$2.1	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 6/ 7/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Fuel Cycle Facilities
Modifying SGI Program	4	0	$0	0	$0	$2.0	$0
Background Checks (not including criminal history records checks based on fingerprinting)	4	18.8	$8.0	3.8	$1.6	$4.5	$0.9
Training Staff	4	116	$49.6	12	$5.1	$0	$0
Marking SGI	4	6.3	$2.7	2.5	$1.1	$0.2	$0
Source Material Licensee
Modifying SGI Program	1	0	$0	0	$0	$0.5	$0
Training Staff	1	116	$12.4	12	$1.3	$0	$0
Marking SGI	1	6.3	$0.7	2.5	$0.3	$0.1	$0
Independent Spent Fuel Storage Installations 8/
Modifying SGI Program	4	0	$0	0	$0	$2.0	$0
Background Checks (not including criminal history records checks based on fingerprinting)	4	18.8	$8.0	3.8	$1.6	$4.5	$0.9
Training Staff	4	116	$49.6	12	$5.1	$0	$0
Marking SGI	4	6.3	$2.7	2.5	$1.1	$0.2	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 6/ 7/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Applicants Subject to § 73.22 4/
Modifying SGI Program	22	20	$8.6	0	$0	$22.0	$0
Training Staff	22	526	$1,238.2	0	$5.1	$0	$0
Marking SGI	22	25	$58.9	17.5	$41.2	$5.5	$0
Applicants Subject to § 73.23 4/
Establishing SGI Program	25	20	$53.5	0	$0	$6.3	$0
Background Checks (including criminal history records checks based on fingerprinting)	25	3	$8.0	1	$2.7	$5.4	$1.8
Training Staff	25	18	$48.2	2	$5.4	$0	$0
Marking SGI	25	0.8	$2.0	0.5	$1.3	$1.3	$0
Holders of CoCs pursuant to 10 CFR Part 71 and Applicants 5/
Marking SGI	50	1.5	$8.0	0.6	$3.3	$0	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 6/ 7/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
NRC
Background Checks (including criminal history records checks based on fingerprinting)	N.A.	0	$0	25	$2.7	$0	$1.8
Training and advice for NRC Staff, Licensees, and State contacts	N.A.	1,400	$149.8	0	$0	$0	$0
Regulatory Guidance	N.A.	1,400	$149.8	0	$0	$0	$0
Total			$6,467.6		$279.9	$207.6	$16.7

^1/ The table includes rounding error.

^2/ Other costs include the fee for a background check, additional storage for SGI, and document stamps for marking SGI.

^3/ Costs = No. of Entities X Hours per Entity X $107 per hour. NRC’s incremental labor rate is $107 per hour.

^4/ The final rule requires certain applicants for licenses to protect SGI or SGI-M. An “applicant” is an entity who submits a license to operate a nuclear power reactor under 10 CFR 50 or to engage in an activity subject to regulation by the Commission; an applicant is also an entity who has provided written notice to the Commission of intent to file an application for licensing, certification, permitting, or approval of a product subject to regulation by the Commission. For the purposes of this analysis only, NRC staff estimates that there are 22 applicants that would protect SGI according to § 73.22 and 25 applicants that would protect SGI-M according to § 73.23. The 22 applicants protecting SGI according to § 73.22 are power reactor applicants so it is assumed that the main analysis costs for power reactor applicants would be the same as for power reactors, except that the annual costs would be calculated over a 40 year license term rather than over 33 years. Note that the current regulations already require power reactors to establish SGI programs, perform background investigations for access authorizations, and perform criminal history checks for access to SGI. Therefore, costs for establishing an SGI program and performing background checks would have been imposed on new reactors in the absence of this rule, and these costs are, thus, not included in either the main analysis or the pre-order analysis.

^5/ Although the Commission has not issued orders to holders of CoCs pursuant to 10 CFR Part 71 and applicants for certificates, the final rule contains provisions for these entities to protect SGI or SGI-M. The certificate holders and applicants are already NRC or Agreement State licensees. Therefore, for the purposes of this analysis, it is assumed that these entities would have already established an SGI or SGI-M program in accordance with the final rule, so the only cost for holders of CoCs pursuant to 10 CFR Part 71 and applicants is marking SGI or SGI-M.

^6/ The NRC licensees that protect classified information are not included in this table because they already protect information at a security level higher than SGI and therefore would not incur costs as a result of the final rule.

^7/ Some licensees received more than one Commission order to protect SGI or SGI-M. To avoid double counting of costs, these licensees are only included in this table once. In addition, it was determined that some licensees who received Commission orders were not subject to them based on the requirements outlined in the orders. These licensees are not included in the table either.

^8/ All of the power reactor sites, 8 of the research and test reactors, and the independent spent fuel storage installations protected SGI according to § 73.21 requirements. However, the final rule would change some of the § 73.21 requirements. Therefore, these licensees still have incremental costs associated with the final rule.

Table 2

Present Value of the Incremental Costs

Associated with the Final Rule

Relative to the Main Baseline

(7 Percent Discount Rate, 2007 Dollars in Thousands) ^1/

Category	Implementation Costs 2/	Annual Operation Costs 3/	Present Value of Total Costs
NRC and Agreement State Licensees	$4,429.0	$2,873.9	$7,302.9
Applicants for Licenses	$1,325.4	$104.3	$1,429.7
Certificate Holders and Applicants	$0	$19.7	$19.7
NRC	$280.0	$31.4	$311.4
Present Value of Total Costs	$6,034.4	$3,029.3	$9,063.7

^1/ The numbers in this table are the present value of the estimated one-time implementation costs and the annual operation costs over 33 years for power reactors, 40 years for power reactor applicants, and 10 years for the other entities from Table 1 at a 7 percent discount rate.

^2/ Implementation costs are the implementation costs plus the one-time other costs from

Table 1, except for applicants for licenses that would be subject to § 73.23. Because there are new applicants every year, these implementation costs are included every year for 10 years beginning in 2008. All other implementation costs are assumed to occur in 2008.

^3/ Annual operation costs are the annual operation costs plus the annual other costs from

Table 1.

Table 3

Present Value of the Incremental Costs

Associated with the Final Rule

Relative to the Main Baseline

(3 Percent Discount Rate, 2007 Dollars in Thousands) ^1/

Category	Implementation Costs 2/	Annual Operation Costs 3/	Present Value of Total Costs
NRC and Agreement State Licensees	$4,601.0	$4,408.0	$9,009.0
Applicants for Licenses	$1,392.2	$126.7	$1,518.9
Certificate Holders and Applicants	$0	$23.8	$23.8
NRC	$290.9	$38.2	$329.0
Present Value of Total Costs	$6,284.1	$4,596.6	$10,880.7

^1/ The numbers in this table are the present value of the estimated one-time implementation costs and the annual operation costs over 33 years for power reactors, 40 years for power reactor applicants, and 10 years for the other entities from Table 1 at a 3 percent discount rate.

^2/ Implementation costs are the implementation costs plus the one-time other costs from

Table 1, except for applicants for licenses that would be subject to § 73.23. Because there are new applicants every year, these implementation costs are included every year for 10 years beginning in 2008. All other implementation costs are assumed to occur in 2008.

^3/ Annual operation costs are the annual operation costs plus the annual other costs from

Table 1.

3.2 Pre-Order Analysis

The pre-order analysis measures the incremental costs and savings of the final rule relative to a baseline prior to the issuance of Commission orders regarding protection of SGI. This analysis accounts for incremental costs and savings associated with the Commission orders and the final rule. It is presented here to give the reader an idea of the total costs and savings of revising the current regulations in § 73.21 according to the final rule. This analysis is for informational purposes only and should not be used to determine whether or not to implement the final rule.

3.2.1 Baseline for the Pre-Order Analysis

The pre-order baseline is how the world would be absent the Commission orders and the final rule. In other words, this baseline is how the world would be under the current regulations at 10 CFR 73.21.

3.2.2 Identification of Affected Attributes in the Pre-Order Analysis

Using the list of potential attributes provided in Chapter 5 of NUREG/BR-0184, “Regulatory Analysis Technical Evaluation Handbook,” this subsection identifies the attributes that the final rule could affect. Relative to the pre-order baseline, the final rule would be expected to affect the following attributes:

• Public and Occupational Health (Accident/Event). The final rule requires more information to be protected as SGI or SGI-M. This would have a positive effect on public and occupational health because it would decrease security threats associated with the disclosure of SGI or SGI-M.

• Offsite Property. The final rule could decrease the risk of offsite property damage and costs (e.g. emergency response) that could follow a terrorist attack or other security-related event associated with the disclosure of SGI or SGI-M.

• Onsite Property. Implementation of the final rule could decrease the risk of potential onsite property damage and costs (e.g. cleanup and decontamination).

• Industry Implementation. Those engaged in an activity subject to regulation by the Commission, applicants to engage in such activities, and individuals who have notified the Commission in writing of an intent to file an application for licensing, certificating, permitting, or approval of a product or activity subject to regulation by the Commission would incur costs to implement the final rule. The final rule would increase the number of entities required to protect SGI. In addition, licensees and applicants that already protect SGI under the current § 73.21 would have to modify their SGI protection programs to meet the requirements of the final rule. Entities in addition to power reactor licensees and applicants would have to perform criminal history records checks, including fingerprints, and background checks to grant access to SGI (power reactors are already required to perform Federal Bureau of Investigation criminal history records checks under § 73.21(c)(1)).

• Industry Operation. For those entities that have not been required to protect SGI under the current regulations, the final rule would increase operation costs (e.g., training of new employees and marking SGI). Those entities that already protect SGI would incur incremental costs as a result of the final rule because the amount of SGI to be protected would increase under the final rule.

• NRC Implementation. The NRC would incur inspection costs to ensure that the final rule requirements have been implemented by its licensees. The NRC would also incur training costs to train NRC inspection staff and those affected by the rule and would be providing advice to those requesting assistance in implementing the requirements of the rule. In addition, the NRC would incur costs associated with writing the regulatory guidance documents for the rule.

• NRC Operation. The NRC would incur the costs of obtaining the FBI criminal history records checks and performing the background checks required by §§ 2.336(f), 2.705(c), 2.709(f), and 2.1010(b)(6) of the final rule.

• Other Government. The final rule would increase state governments’ costs. States would be required to protect SGI and SGI-M.

• Safeguard and Security Considerations. The final rule would increase the level of protection of SGI, and thereby increase the common defense and security of the nation.

Relative to the pre-order baseline, the final rule would not be expected to affect the following attributes:

• Public Health (Routine)

• Occupational Health (Routine)

• General Public

• Improvements in Knowledge

• Regulatory Efficiency

• Environmental Considerations

3.2.3 Methodology of the Pre-Order Analysis

This subsection describes the methodology used to analyze the incremental values and impacts associated with the final rule relative to the pre-order baseline described in 3.2.1 above. The values (savings) include any desirable changes in the affected attributes, while the impacts (costs) include any undesirable changes in the affected attributes. This analysis relies on both quantitative and qualitative analyses of the affected attributes. The quantitative analysis involves the assessment of costs and savings associated with the final rule. The qualitative analysis involves a discussion of those attributes that the NRC was not able to quantify.

In accordance with Office of Management and Budget Circular No. A-4, “Regulatory Analysis,” and NUREG/BR0058, Rev. 4, the results of the analysis are presented using both 3 percent and 7 percent real discount rates.

3.2.4 Affected Universe of the Pre-Order Analysis

The entities that would be affected by the final rule relative to the pre-order baseline are shown in Table 4 below. (Please note that the word “entity” is meant to include NRC and Agreement State licensees as well as others affected by the final rule.) Under the pre-order analysis, it is assumed that prior to the implementation of the final rule only those licensees protecting SGI under the current regulations at § 73.21 have incurred SGI-related costs. The licensees currently protecting SGI under § 73.21 would incur costs in the pre-order analysis because the final rule expands the information to be protected, requires trustworthiness and reliability determinations for the research and test reactors currently subject to § 73.21, expands the scope of individuals subject to background checks and criminal history records checks including fingerprinting, and changes the SGI marking requirements.

3.2.5 Analysis of Values in the Pre-Order Analysis

There are no quantifiable values (i.e. benefits) associated with the final rule. The qualitative values of the final rule are associated with safeguard and security considerations or the decreased risk of a security-related event, such as an act of sabotage or a terrorist attack. Increasing the security of SGI and SGI-M decreases this risk and increases the common defense and security of the nation. Other qualitative values that are positively affected by the decreased risk of a security-related event include public and occupational health due to an accident or event and the risk of damage to onsite and offsite property.

3.2.6 Analysis of Impacts in the Pre-Order Analysis

The assumptions used in analyzing the quantifiable impacts (costs) associated with the final rule are discussed in this subsection. These costs are associated with the entities identified in Table 4 that would be required to protect SGI and SGI-M under the final rule. The hourly rate applied to labor hours is $107 per hour. This is NRC’s incremental labor rate which includes only those variable costs associated with implementation and operation costs of the orders and the final rule. Use of this labor rate is consistent with Section 5.2 of NUREG/CR–4627, Generic Cost Estimates. It is assumed that licensees, applicants, and state contacts have a similar labor rate.

3.2.6.1 Licensee, Holders of CoCs Pursuant to 10 CFR Part 71, and Applicant Costs

1. Implementation Costs. Under the final rule the licensees, including holders of CoCs pursuant to 10 CFR Part 71, as wells as applicants to engage in Commission-regulated activities and applicants for Part 71 certificates would be required to either establish a program to designate and protect SGI or SGI-M or to modify an existing SGI protection programs. These entities are identified in Table 4. For the purposes of this analysis, it is assumed that the implementation costs for the licensees and the holders of CoCs pursuant to 10 CFR Part 71, including the labor and other costs discussed below, are incurred in 2008. Because there are new applicants subject to § 73.23 every year, implementation costs for these applicants are calculated every year for 10 years beginning in 2008. The estimated present value of total implementation costs in 2007 dollars at a 7 percent discount rate is $6.4 million. The estimated present value of these costs in 2007 dollars at a 3 percent discount rate is $6.6 million (see Tables 4, 5, and 6).

A. Labor Costs. Implementation costs include planning, establishing, and documenting a SGI or SGI-M program; initial marking of SGI or SGI-M documents; determining personnel access to SGI or SGI-M (making need to know determinations, performing background checks to determine trustworthiness and reliability, and collecting fingerprints for FBI criminal history records checks); and training personnel to designate and protect SGI or SGI-M. Based on licensee and NRC staff estimates of these costs, the labor costs associated with licensee implementation of the SGI and SGI-M requirements in the final rule relative to the pre-order baseline are approximately $6.1 million at a 7 percent discount rate and $6.3 million at a 3 percent discount rate.

B. Equipment and Other Costs. Implementation costs also include the equipment required to process, mark, and store SGI or SGI-M as required in the final rule. Examples of required equipment include document marking stamps and a safe (for entities protecting SGI) or a locking file cabinet (for entities protecting SGI-M). Another cost associated with the final SGI and SGI-M requirements are the cost of background and criminal history records checks for entities who were not required by § 73.21 to protect SGI. The licensee labor costs associated with gathering data for the background check are included in the labor costs above. Most licensees would then pay for an outside vendor to run a background check. This fee is included as an “other cost” in Table 4. It is estimated that the total cost for equipment and other costs to implement the final rule is approximately $0.3 million at a 7 percent discount rate and $0.3 million at a 3 percent discount rates. For the purposes of this regulatory analysis, it is assumed that licensees would not have to acquire office space for the additional equipment required to protect SGI.

2. Annual Operation Costs. After establishing or modifying an SGI or SGI-M program, annual operation costs would be incurred by NRC and Agreement State licensees and applicants and holders of CoCs pursuant to 10 CFR Part 71 and applicants. The estimated licensee and applicant annual operation costs, including the labor and other costs discussed below, are approximately $3.5 million at a 7 percent discount rate and $5.1 million at a 3 percent discount rate (see Tables 4, 5, and 6). For power reactors, annual costs are calculated over 33 years of remaining plant life beginning in 2008. This plant life was calculated assuming 100 percent of power reactor licenses will be renewed for one 20-year renewal period. For power reactor applicants, annual costs were calculated over a 40 year period, the term of a power reactor operating license. Annual costs for all other licensees are calculated for 10 years beginning in 2008 based on the assumption that there is an average of 10 years left on their current license.

A. Labor Costs. The annual operation costs associated with an SGI program include designating and protecting new SGI, training new personnel, and collecting fingerprints (for criminal history records checks) and other information (for background checks) from new personnel. At a discount rate of 7 percent the present value of these costs is approximately $3.3 million in 2007 dollars. At a 3 percent discount rate, the present value of these costs in 2007 dollars is approximately $4.9 million.

B. Other Costs. In addition to the labor associated with FBI criminal history records checks and background checks included in A. above, licensees would incur fees associated with having a vendor run background checks and the FBI run criminal history records checks on new employees. The present value of these costs in 2007 dollars at a discount rate of 7 percent is approximately $0.2 million. At a 3 percent discount rate, the present value of these costs in 2007 dollars is approximately $0.3 million.

3.2.6.2 NRC Costs

1. Implementation Costs. The NRC would incur costs to implement the final rule. The estimated NRC implementation costs, including the labor and other costs discussed below, are approximately $551.0 thousand at a 7 percent discount rate and $561.3 thousand at a 3 percent discount rate (see Tables 4, 5, and 6).

A. Labor Costs. NRC’s labor costs associated with the implementation of the final rule relative to the pre-order baseline are the inspection costs associated with ensuring that licensees have implemented the final rule requirements, the cost of producing regulatory guidance documents, and training NRC staff, licensees, and state contacts on the new SGI requirements. The labor portion of NRC implementation costs is approximately $515.1 thousand at a 7 percent discount rate and $524.8 thousand at a 3 percent discount rate.

B. Other Costs. The NRC would also incur costs to purchase SGI-related equipment for some Agreement State contacts. The cost of this equipment is estimated to be approximately $35.9 thousand at a 7 percent discount rate and $36.6 thousand at a 3 percent discount rate.

2. Annual Operation Costs. The NRC would inspect licensees with respect to the SGI requirements of the final rule. However, these inspections would be part of the normal inspections the NRC already conducts so none of these costs are included in this analysis. The cost to the NRC to obtain the FBI criminal history records checks and perform the background checks as required by §§ 2.336(f), 2.705(c), 2.709(f), and 2.1010(b)(6) of the final rule are included here. The NRC estimates that it would need to obtain FBI criminal history records checks and perform background checks for 25 individuals per year. Over 10 years, the present value of this annual operation cost at a discount rate of 7 percent is approximately $36.3 thousand. Labor costs account for $15.3 thousand of this amount. At a discount rate of 3 percent, the cost is approximately $44.1 thousand over the same time period. Labor costs account for $18.6 thousand of this amount.

3.2.6.3 State Government Costs

1. Implementation Costs. State governments would incur costs to implement the final rule relative to the pre-order baseline. Implementation costs for state governments are estimated to be $368.5 thousand at a 7 percent discount rate and $375.5 thousand at a 3 percent discount rate (see Tables 4, 5, and 6).

A. Labor Costs. State labor costs associated with implementing the final rule include planning, establishing, and documenting or modifying a SGI or SGI-M program; initial marking of SGI or SGI-M documents; determining personnel access to SGI and SGI-M; and training personnel to designate and protect SGI and SGI-M. Based on state contact estimates of these costs, the labor costs associated with implementation of the SGI and SGI-M requirements in the final rule relative to the pre-order baseline are approximately $310.5 thousand at a 7 percent discount rate and $316.3 thousand at a 3 percent discount rate.

B. Other Costs. State governments would also be required to purchase equipment to designate and protect SGI or SGI-M. This equipment includes locking file cabinets to store SGI-M and document stamps to mark SGI and SGI-M. The estimated cost of this equipment is $58.0 thousand at a 7 percent discount rate and $59.1 at a 3 percent discount rate.

2. Annual Operation Costs. State contacts would incur annual operation costs to designate and protect new SGI or SGI-M, determine SGI and SGI-M access for new employees, and train new employees on SGI and SGI-M requirements. These costs are all labor costs. The present value of annual operation costs in 2007 dollars at a discount rate of 7 percent are estimated to be $5.0 million. At a 3 percent discount rate, the present value of operation costs in 2007 dollars are estimated to be $6.0 million.

3.2.7 Results of the Pre-Order Analysis

1. Implementation Costs. The total implementation costs in 2007 dollars associated with the final rule relative to the pre-order baseline are estimated to be $7.3 million at a 7 percent discount rate and $7.6 million at a 3 percent discount rate. Of the $7.3 million amount, the labor costs are $6.9 million and the other costs for equipment and background checks are $0.4 million. Of the $7.6 million amount, the labor costs are $7.2 million and the other costs for equipment and background checks are $0.4 million. Tables 5 and 6 provide a summary of the implementation costs for licensees, applicants, holders of CoCs pursuant to 10 CFR Part 71, the NRC, and state contacts.

2. Annual Operation Costs. The total annual operation costs associated with the final rule relative to the pre-order baseline at a 7 percent discount rate are estimated to be

$8.5 million. Of this amount, labor costs account for $8.2 million and the other costs for background checks account for $0.3 million. At a 3 percent discount rate the total estimated annual operation costs of the final rule are estimated to be $11.2 million. Of this amount, labor costs account for $10.9 million while other costs account for $0.3 million. Tables 5 and 6 provide a summary of the annual operation costs for licensees, applicants, holders of CoCs pursuant to 10 CFR Part 71, the NRC, and state contacts.

As shown in Table 5, the present value of the total cost of the final rule relative to the pre-order baseline at a 7 percent discount rate is estimated to be $15.8 million. At a 3 percent discount rate, the total estimated cost of the final rule is estimated to be $18.8 million (see Table 6). Although there are no quantitative benefits under the final rule alternative, there are significant qualitative benefits of the final rule relative to the pre-order baseline. These qualitative values include (1) a positive effect on public and occupational health, (2) increased protection of onsite and offsite property, and (3) increased protection of the common defense and security of the nation.

Table 4

Pre-Order Analysis Data

(Cost Data in 2007 Dollars in Thousands) ^1/

		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 8/ 9/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Power Reactor Sites 10/
Modifying SGI Program	64	0	$0	0	$0	$64.0	$0
Training Staff	64	526	$3,602.0	0	$0	$0	$0
Marking SGI	64	25	$171.2	17.5	$119.8	$16.0	$0
Research and Test Reactors 10/
Modifying SGI Program (§ 73.22)	8	0	$0	0	$0	$4.0	$0
Establishing SGI Program (§ 73.23)	42	20	$89.9	0	$0	$10.5	$0
Background Checks (including criminal history records checks based on fingerprinting)	50	25	$133.8	5	$26.8	$90.0	$18.0
Training Staff (§ 73.22)	8	116	$99.3	0	$0	$0	$0
Training Staff (§ 73.23)	42	116	$521.3	12	$53.9	$0	$0
Marking SGI (§ 73.22)	8	6.3	$5.4	1.3	$1.1	$0.4	$0
Marking SGI (§ 73.23)	42	6.3	$28.1	2.5	$11.2	$2.1	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 8/ 9/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Fuel Cycle Facilities
Establishing SGI Program	4	20	$8.6	0	$0	$2.0	$0
Background Checks (including criminal history records checks based on fingerprinting)	4	25	$10.7	5	$2.1	$7.2	$1.4
Training Staff	4	116	$49.6	12	$5.1	$0	$0
Marking SGI	4	6.3	$2.7	2.5	$1.1	$0.2	$0
Source Material Licensee
Establishing SGI Program	1	20	$2.1	0	$0	$0.5	$0
Background Checks (including criminal history records checks based on fingerprinting)	1	25	$2.7	5	$0.5	$1.8	$0.4
Training Staff	1	116	$12.4	12	$1.3	$0	$0
Marking SGI	1	6.3	$0.7	2.5	$0.3	$0.1	$0
Independent Spent Fuel Storage Installations
Modifying SGI Program	4	0	$0	0	$0	$2.0	$0
Background Checks (including criminal history records checks based on fingerprinting)	4	25	$10.7	5	$2.1	$7.2	$1.4
Training Staff	4	116	$49.6	12	$5.1	$0	$0
Marking SGI	4	6.3	$2.7	2.5	$1.1	$0.2	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 8/ 9/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Applicants Subject to § 73.22 4/
Modifying SGI Program	22	0	$0	0	$0	$22.0	$0
Training Staff	22	526	$1,238.2	0	$0	$0	$0
Marking SGI	22	25	$58.9	17.5	$41.2	$5.5	$0
Irradiators
Establishing SGI Program	49	20	$104.9	0	$0	$12.3	$0
Background Checks (including criminal history records checks based on fingerprinting)	49	3	$15.7	1	$5.2	$10.6	$3.5
Training Staff	49	18	$94.4	2	$10.5	$0	$0
Marking SGI	49	0.8	$3.9	0.5	$2.6	$2.5	$0
Manufacturers and Distributors
Establishing SGI Program	28	20	$59.9	0	$0	$7.0.	$0
Background Checks (including criminal history records checks based on fingerprinting)	28	3	$9.0	1	$3.0	$6.0	$2.0
Training Staff	28	18	$53.9	2	$6.0	$0	$0
Marking SGI	28	0.8	$2.2	0.5	$1.5	$1.4	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 8/ 9/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
Licensees with Radioactive Materials in Quantities of Concern 11/
Establishing SGI Program	40	20	$85.6	0	$0	$10.0	$0
Background Checks (including criminal history records checks based on fingerprinting)	40	3	$12.8	1	$4.3	$8.6	$2.9
Training Staff	40	18	$77.0	2	$8.6	$0	$0
Marking SGI	40	0.8	$3.2	0.5	$2.1	$2.0	$0
Applicants Subject to § 73.23 4/
Establishing SGI Program	25	20	$53.5	0	$0	$6.3	$0
Background Checks (including criminal history records checks based on fingerprinting)	25	3	$8.0	1	$2.7	$5.4	$1.8
Training Staff	25	18	$48.2	2	$5.4	$0	$0
Marking SGI	25	0.8	$2.0	0.5	$1.3	$1.3	$0
Holders of CoCs pursuant to 10 CFR Part 71 and Applicants 5/
Marking SGI	50	1.5	$8.06.5	0.6	$3.32.7	$0	$0
		Implementation		Annual Operation		Other Costs 2/
Type of Cost by Entity	No. Of Entities 8/ 9/	Hours per Entity	Costs 3/	Hours per Entity	Costs Per Year 3/	One-Time	Annual
NRC
Training and advice for NRC Staff, Licensees, and State Contacts	N.A.	1,400	$149.8	0	$0	$0	$0
Regulatory Guidance	N.A.	3,000	$321.0	0	$0	$0	$0
Inspections	N.A.	353	$37.8	0	$0	$0	$0
Agreement State Costs 6/	28	8	$24.0	0	$0	$37.1	$0
Background Checks (including criminal history records checks based on fingerprinting)	N.A.	0	$0	25	$2.7	$0	$1.8
State Contacts 7/
Liaison Officers	50	20	$107.0	44	$235.4	$15.0	$0
Radiation Control Program Directors	50	20	$107.0	44	$235.4	$15.0	$0
Transportation Directors	50	0	0	0	$0	$15.0	$0
Homeland Security Advisors	50	20	$107.0	44	$235.4	$15.0	$0
Total			$7,596.4		$1,038.2	$406.0	$34.0

^1/ The table includes rounding error.

^2/ Other costs include the fee for a background check, additional storage for SGI, and document stamps for marking SGI.

^3/ Costs = No. of Entities X Hours per Entity X $107 per hour. NRC’s incremental labor rate is $107 per hour.

^4/ The final rule would require certain applicants for licenses to protect SGI or SGI-M. An “applicant” is an entity who submits a license to operate a nuclear power reactor under 10 CFR part 50 or to engage in an activity subject to regulation by the Commission; an applicant is also an entity who has provided written notice to the Commission of intent to file an application for licensing, certification, permitting, or approval of a product subject to regulation by the Commission. For the purposes of this analysis only, NRC staff estimates that there are 22 applicants that would protect SGI according to § 73.22 and 25 applicants that would protect SGI-M according to § 73.23. The 22 applicants protecting SGI according to § 73.22 are power reactor applicants so it is assumed that the main analysis costs for power reactor applicants would be the same as for power reactors, except that the annual costs would be calculated over a 40 year license term rather than over 33 years. Note that the current regulations already require power reactors to establish SGI programs, perform background investigations for access authorizations, and perform criminal history checks for access to SGI. Therefore, costs for establishing an SGI program and performing background checks would have been imposed on new reactor applicants in the absence of this rule, and these costs are, thus, not included in either the main analysis or the pre-order analysis.

^5/ Although the Commission has not issued orders to holders of CoCs pursuant to 10 CFR Part 71 and applicants for certificates, the final rule contains provisions for these entities to protect SGI or SGI-M. The certificate holders and applicants are already NRC or Agreement State licensees. Therefore, for the purposes of this analysis, it is assumed that these entities would have already established an SGI or SGI-M program in accordance with the final rule, so the only costs associated with holders of CoCs pursuant to 10 CFR Part 71 and applicants is marking SGI or SGI-M.

^6/ Agreement state costs paid by NRC include SGI training and equipment costs. The training costs were calculated as follows:

8 hours of SGI training X 28 Agreement State attendees X $107 per hour = $24.0 thousand. The “One-Time Other Costs” column includes Agreement State travel costs to the training which were calculated as follows: 28 Agreement State attendees X $1,600 in travel costs per attendee X 1/8 of total training that was associated with SGI handling = $5.6 thousand. The remaining amount in the “One-Time Other Costs” column is $31.5 thousand for SGI-related equipment purchases for 9 Agreement States.

^7/ State contacts are the contacts in each state with which the NRC coordinates its activities. The state transportation contacts already protected SGI prior to the final rule so some of their costs are not included in this table.

^8/ The NRC licensees that protect classified information are not included in this table because they already protect information at a security level higher than SGI and therefore would not incur costs as a result of the final rule.

^9/ Some licensees received more than one Commission order to protect SGI or SGI-M. To avoid double counting of costs, these licensees are only included in this table once. In addition, it was determined that some licensees who received Commission orders were not subject to them based on the requirements outlined in the orders. These licensees are not included in the table either.

^10/ All of the power reactors and 8 of the research and test reactors protected SGI prior to Commission orders requiring additional information be protected as SGI according to § 73.21 requirements. However, the final rule would change some of the § 73.21 requirements. Therefore, these licensees still have incremental costs associated with the final rule.

^11/ The Commission issued orders to RAMQC licensees in summer 2005.

Table 5

Present Value of the Incremental Costs

Associated with the Final Rule

Relative to the Pre-Order Baseline

(7 Percent Discount Rate, 2007 Dollars in Thousands) ^1/

Category	Implementation Costs 2/	Annual Operation Costs 3/	Present Value of Total Costs
NRC and Agreement State Licensees	$5,044.3	$3,236.1	$8,280.4
Applicants for Licenses	$1,325.4	$221.0	$1,546.4
Certificate Holders and Applicants	$0	$23.5	$23.5
NRC	$551.0	$36.3	$587.4
State Contacts	$368.5	$4,960.1	$5,328.6
Present Value of Total Costs	$7,289.3	$8,477.0	$15,766.2

^1/ The numbers in this table are the present value of the estimated one-time implementation costs and the annual operation costs over 33 years for power reactors, 40 years for power reactor applicants, and 10 years for the other entities from Table 4 at a 7 percent discount rate.

^2/ Implementation costs are the implementation costs plus the one-time other costs from

Table 4, except for applicants for licenses which would be subject to § 73.23. Because there are new applicants every year, these implementation costs are included every year for

10 years beginning in 2008. Other implementation costs are assumed to occur in 2008.

^3/ Annual operation costs are the annual operation costs plus the annual other costs from

Table 4.

Table 6

Present Value of the Incremental Costs

Associated with the Final Rule

Relative to the Pre-Order Baseline

(3 Percent Discount Rate, 2007 Dollars in Thousands) ^1/

Category	Implementation Costs 2/	Annual Operation Costs 3/	Present Value of Total Costs
NRC and Agreement State Licensees	$5,238.6	$4,847.8	$10,086.4
Applicants for Licenses	$1,392.2	$268.4	$1,660.6
Certificate Holders and Applicants	$0	$28.5	$28.5
NRC	$561.3	$44.1	$605.5
State Contacts	$375.5	$6,024.0	$6,399.5
Present Value of Total Costs	$7,567.7	$11,212.9	$18,780.5

^1/ The numbers in this table are the present value of the estimated one-time implementation costs and the annual operation costs over 33 years for power reactors, 40 years for power reactor applicants, and 10 years for the other entities from Table 4 at a 3 percent discount rate.

^2/ Implementation costs are the implementation costs plus the one-time other costs from

Table 4, except for applicants for licenses which would be subject to § 73.23. Because there are new applicants every year, these implementation costs are included every year for

10 years beginning in 2008. Other implementation costs are assumed to occur in 2008.

^3/ Annual operation costs are the annual operation costs plus the annual other costs from

Table 4.

4. Backfit Analysis

The backfit requirements contained in this final rule are necessary to ensure that the SGI related to the facilities and materials described in the final rule are protected in the manner necessary to ensure adequate protection of the public health and safety or the common defense and security. The protection of SGI under the current regulations in § 73.21 is not adequate for the current threat environment. The requirements of the final rule that are not in the current § 73.21 or in Commission orders constitute an adequate protection exception to the backfit rule. These requirements of the final rule are as follows:

(1) additional information to be protected as SGI in §§ 73.22(a)(1)(xi), 73.22(a)(1)(xii), 73.22(a)(2)(vii), and 73.22(a)(2)(viii) of the final rule;

(2) trustworthiness and reliability determinations for access to SGI in § 73.22(b)(2); and

(3) SGI marking requirements in § 73.22(d).

Because these requirements are an adequate protection exception to the backfit rule, a backfit analysis is not required and the cost-benefit standards of §§ 50.109(a)(3), 70.76, 72.62, and 76.76 do not apply.

5. Decision Rationale

The decision rationale is based on the main analysis. The pre-order analysis is provided for informational purposes only. The values and impacts of the main analysis have been considered. Although significant costs are incurred as a result of the final rule, the qualitative benefits associated with the rule outweigh its costs.

6. Implementation

The final rule will be implemented in FY 2008 through regulatory guidance, inspections, and training NRC staff, licensees, and State contacts. Some of the implementation activities have already been undertaken as a result of the Commission’s security orders. The estimated NRC resources associated with implementing the SGI protection provisions associated with the final rule are approximately 2 full-time equivalent employees (FTEs). These resources will come from the Office of Nuclear Security and Incident Response (NSIR) and have been budgeted in FY 2008:

NSIR: 2 FTE

APPENDIX A

REGULATORY FLEXIBILITY ACT CONSIDERATIONS

Regulatory Flexibility Act Considerations

In accordance with the Regulatory Flexibility Act of 1980, 5 U.S.C. 605(b), the NRC has determined that this rule, if adopted, will not have a significant economic impact upon a substantial number of small entities. The NRC estimates that the regulation will affect approximately 152 NRC licensees, 87 Agreement State licensees, 200 state contacts, and 29 applicants for licenses. The NRC estimates that small businesses as defined by 10 CFR 2.810 comprise less than 1 percent of the total number of NRC licensees and state contacts affected by this regulation. The NRC does not have information on the small business status of the Agreement State licensees or applicants for NRC and Agreement State licenses affected by this regulation. Therefore, in its February 11, 2005 and October 31, 2006, Federal Register notices and the regulatory analyses for the proposed rules, the NRC requested public comments on the impact of the proposed rules on small businesses. No comments were received from entities identifying themselves as "small businesses" meeting the criteria in 10 CFR 2.810, "NRC size standards." In the absence of information on the small business status of the Agreement State licensees and applicants for NRC and Agreement State licenses affected by this regulation and based on the small proportion of NRC licensees that qualify as small entities, the NRC estimates that the number of small entities among these licensees is also less than 1 percent. For a small entity, the implementation burden imposed by the regulation is estimated to be 41.8 hours, and the annual burden is estimated to be 3.5 hours.

The potential benefits of preventing disclosure of SGI by unauthorized persons significantly outweigh the economic impact on small licensees.