28. Contingency Planning - Sandia National … - Contingency Planning The Twenty-Sixth International Training Course Page 3 5 Contingency Planning Objectives of a Contingency Plan

28 - Contingency Planning

The Twenty-Sixth International Training CoursePage 1

28. Cont ingency P lanning

October 24 – November 11, 2016Albuquerque, New Mexico, USA

Joseph Sandoval

2

Contingency Planning

Learn ing Object ives

After completing this module, you should be able to:• Define the definition and basis for contingency plans • Define the relationship between preparedness activities

and contingency planning• List several reasons a contingency plan is important • List some outcomes of poor contingency planning• Define concepts to develop a good contingency plan• Define use of exercises and evaluations in improving a

contingency plan



3


Def in i t ions

Security Plans: A plan describing design, implementation, and sustainment of physical protection measures at a nuclear facilityContingency Plan: Predefined sets of actions for response to unauthorized acts indicative of attempted unauthorized removal or sabotage, including threats thereof, designed to effectively counter such actsEmergency Plans: Predefined sets of actions for response to safety events or other emergency events. Measures to ensure the mitigation or minimization of the radiological consequences of sabotage as well as human error, equipment failure, and natural disastersPreparedness: Engaging in a continuous cycle of contingency planning, organizing, training, equipping, exercising, evaluating, and taking corrective action to achieve and maintain readiness to respond to unauthorized actsDeliberate Planning: A planning process to deal with a hypothetical situation. Deliberate planning relies on assumptions regarding the circumstances that will exist when the plan is executed

4


Cont ingency P lanning Bas is

• Amended CPPNM, Fundamental Principle K: Contingency Plans: “Contingency (emergency) plans to respond to unauthorized removal of

nuclear material or sabotage of nuclear facilities or nuclear material, or attempts thereof, should be prepared and appropriately exercised by all licence holders and authorities concerned.”

• NSS 13 has more than 30 recommendations that explicitly mention contingency plans, or have implicit recommendations associated with elements of a security plan. The recommendations cover topics such as: Contingency planning Cooperation between Competent Authority and other agencies Integration with other contingency plans Training, testing, and evaluations



5


Object ives of a Cont ingency P lan

• Prevent theft of nuclear material• Locate and recover missing nuclear material• Mitigate or minimize effect of sabotage

6


Types of P lans

Facility Plans

Facility Plans

Safety PlanSafety Plan Emergency PlanEmergency Plan

Security PlanSecurity Plan Contingency PlansContingency Plans

The security plan should include sections dealing with…contingency plans. NSS 13, 3.27



7


P lan Examples

Contingency PlanResponse to Unauthorized Acts

Emergency PlanResponse to Safety / Emergency Event

Protestors – Unacceptable impact to facility operations

Natural disaster – Earthquake, flooding, hurricane

Criminal acts – Theft of nuclear material

Human‐caused accident

Terrorist act – Sabotage, facility takeover, theft of nuclear material

Critical equipment malfunction or failure

Insider malicious act – Theft or sabotage

Medical emergency

8


Cont ingency P lan Implementat ion

• Implemented when a potential malicious act has occurred: Suspicious activity

• Improperly applied tamper-indicating device (TID)• Unsecured lock or room

Observed act• Access to areas where not authorized

Detected act• Activation of portal monitor



9


Cont ingency P lan Object ive

• The objective of a contingency plan is to guide a systematic, coordinated, and effective response to: Regain control of the facility Secure the facility during mitigation and recovery operations

(protect emergency equipment and personnel) Prevent further damage

10


Cons istency of Cont ingency P lans

Operator

Security

Security Plan

Contingency Plans

Safety

Safety Plan

Emergency Plans

State

Security

Security Plan

Contingency Plans

Safety

Safety Plan

Emergency Plans



11


Re la t ionsh ip Between Preparedness and Cont ingency P lann ing• Preparedness involves:

Contingency planning Organizing Training Equipping Exercising Evaluating Corrective Actions

• Contingency planning is part of a broader program of preparedness and close cooperation between operator, competent authority, and other agencies involved in a response to a nuclear incident

Integrated Contingency Planning + Communication and Information Sharing + Cooperation + Joint Training = Preparedness

12


Importance of Cont ingency P lanning

• Contingency planning is key to responding effectively and consistently to a security incident Many State plans involve responders from different disciplines,

agencies, and jurisdictions Each may have different responsibilities, but all share the same

goals

• Goal of a contingency plan is to provide an effective and efficient response to a security incident Plan provides a framework for a consistent and standardized

approach Plan allow responders to work together effectively and respond

in a coordinated manner to a security incident regardless of cause, size, or complexity



13


H istor ica l Lessons Learned

• Waco Incident, US, 1993 Illustrated the importance of integrated planning, communication

and information sharing, cooperation, and joint training for a multi-agency response to an incident

• London Underground Attack, UK, 2005 Illustrated the importance of integrated planning between all

agencies involved and ensuring the ability to communicate and share information during an incident

• Special Action Force Raid, Philippines, 2015 Illustrated the importance of communication and information

sharing between agencies responsible for supporting each other during an incident

14


Waco Inc ident V ideo



15


Cont ingency P lanning Concepts

• A good contingency plan: Is a deliberate plan to respond to a security incident Addresses resources and scaling Defines roles and responsibilities Includes a communications plan Describes actions during all phases of a security incident Uses alert levels to quickly communicate status Defines response actions for each defined threat and each

protection strategy Defines incident reporting and documentation requirements Is routinely exercised and evaluated Forms the basis of training for all agencies, organizations, and

personnel involved in a response

16


De l iberate P lanning

• Contingency planning should: Be conducted on an ongoing basis Be developed as a management plan, not a plan

describing response force tactics or operations Be Used as a framework for decision making

during a security incident, but allow for critical decision-making within defined bounds

Have scalable capacities to meet a range of security incidents Have elements of flexibility and adaptability Reach across all organizational, jurisdictional, and disciplinary

lines and be designed to improve coordination Be iterative – Lessons learned from exercises, tests, and real

events should be used to continuously improve plans

The plan is ultimately a high‐

level set of decisions about what to do, why to do it, when to do it, and how to

do it.



17


Resources and Scal ing

• Part of the deliberate contingency planning process is to identify all resources that may be needed during all phases of a security incident Careful consideration should be given to planning for the ability to scale

resources (increase or decrease based on the circumstances of the security incident)

• Examples of resources are: Response Force personnel Response Force vehicles Response Force weapons and equipment Fire Fighting personnel Medical personnel Radiation technicians Decontamination teams Canine search teams Public Relations teams

18


Ro les and Responsib i l i t ies

• Lack of clear roles and responsibilities leads to problems Roles are generally the positions assumed by specific personnel

or the parts they play in a particular operation or process Responsibilities are specific tasks or duties that personnel are

expected to complete as a function of their roles

• Formal roles should be defined; informal roles understood Formal roles are essentially “who” is responsible for “what” Informal roles are not assigned, but are assumed by individuals because

of their personalities, motivations, individual styles and attitudes, or the ways they approach situations or tasks

• It is important to ensure roles and responsibilities are understood by all parties involved



19


Command and Cont ro l and Cha in o f Command

Command and control: The exercise of authority and direction by a properly designated group or individual over assigned resources in the accomplishment of a common goalChain of command: Defines who is in charge of a security incident and how that command is passed to others

20


Impor tance o f Communicat ion in a Success fu l Response• Effective security incident response activities rely on:

Flexible communications Information systems that provide a common operating picture to

site management and response personnel

• Incident communications are facilitated through: Development and use of common communications plans Interoperable communications equipment, processes, standards,

and architectures



21


Impor tance o f Communicat ion in a Success fu l Response• Some important considerations to consider regarding

communication when developing a contingency plan: A communication plan should be part of a contingency plan

• There should be interoperability between communications systems of different agencies and organizations with a role in a response

• Communications systems should be reliable, portable, resilient, and redundant

Communications plan should define common terminology and direct that plain language be used whenever possible

• Encryption or tactical language may be used to provide more secure communications

22


Ac t i v i t i es Dur ing A l l Secur i ty Inc ident Phases

• The contingency plan should describe actions taken during all phases of a security event: Pre-incident actions – Describe actions to conduct if an indication

of a possible incident is received (that is, from intelligence sources or local law enforcement)

Describe actions during the security incident Post-incident actions – Describe actions to bring the site back

under control, begin to treat casualties, and mitigate damage to facilities or materials

• During this time, careful consideration should be given and documented in the contingency plan regarding how to transition from a security incident to an emergency response



23


A lert Levels

• Alert levels are a method that can be developed to aid in quick communication

• Alert levels can be used to Communicate the status of the site Trigger specific actions defined in the contingency plan

• Examples of alert levels: Level I - Normal Operations Level II - Heightened Awareness Level III - Imminent Threat Level IV - Incident Response Level V – Recovery Operations

24


Spec i f ic Response Act ions

• The action plan portion of a contingency plan describes an organized course of action for each type of security incident during all phases of the incident, including What needs to be done Who is responsible for it When it is to be accomplished Where it is to be accomplished

• How each action is accomplished should be covered in other procedures and protocols Procedures and protocols should detail the specific actions necessary to

implement required elements in a contingency plan• All organizations involved should have developed specific, action-oriented

checklists for use during security incident response operations so they can perform their role as defined in the contingency plan



25


Not i f icat ion and Report ing

• The contingency plan should address incident reporting and documentation Situation reports offer a snapshot of the past operational period

and contain confirmed or verified information regarding the explicit details (who, what, when, where, and how) relating to the incident

Status reports, which may be contained in situation reports, relay information specifically related to the status of resources (e.g., availability or assignment of resources)

Incident reporting and documentation procedures should be standardized to ensure that situational awareness is maintained and that site management and response personnel have easy access to critical information

26


Cont ingency P lan Tra in ing , Exerc i s ing , and Eva luat ing• Development of a contingency plan is not a one time

activity, but an iterative activity to ensure response to security incidents is effective It should form the basis for training of all organizations with a

role in response to a security incident, including site employees It should be routinely exercised by use of methods such as

tabletop exercises, limited scope performance tests, and large-scale whole system performance tests

Evaluation results and lessons learned should be used to update the contingency plan as necessary



27


Sample Cont ingency P lan Out l ine for L IMP Fac i l i ty

28


Summary

• Contingency planning is one of the most important activities at a nuclear facility to ensure the site can effectively respond to and prevent threats attempting theft of nuclear material or sabotage of nuclear facilities or nuclear materials

• Contingency planning has a strong basis in the Amended CPPNM and in NSS 13 Contingency plans are a component of a broader set of

preparedness activities

• Contingency plans should be regularly trained, tested, and evaluated, and updated as necessary Poor contingency planning can have catastrophic results

Documents

28. Contingency Planning - Sandia National … - Contingency Planning The Twenty-Sixth International Training Course Page 3 5 Contingency Planning Objectives of a Contingency Plan