9
9
9
9
Communication is a hallmark of a healthy corporate culture and should be encouraged so that staff are informed about nuclear security procedures, and understand the wider context that informs decision-making. Indeed, involvement of staff is recognised by the IAEA as an indicator of effective nuclear security culture.
The dissemination of sensitive information is a potential security risk, even within organisations. Key documents such as INFCIRC/225 (Rev.5) ‘Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities’ emphasise the importance of the principles of confidentiality and the need for actors to adopt a ‘graded approach’ to information security. Here, having fewer people eligible to access sensitive information is seen as decreasing the risk of deliberate or inadvertent disclosure or discussion of such information.
Management must balance increased staff buy-in of management decisions against the potential of sensitive information being leaked. For example, changes can be discussed with staff in broad outlines, without going into specific details. Alternatively, management can draw on examples of poor security at other sites and industries to better articulate their concerns without compromising operational information.
In balancing the dissemination of information and the principle of ‘need to know’, management should foster a working culture where staff can raise questions and issues, but understand that there are limits to the information that can be shared, or feedback given, due to security concerns.
It is notable however, that internationally there are no established standards regarding information security. Key documents such as the IAEA’s ‘Objective and Essential Elements of a State’s Nuclear Security Regime’ address information security and calls for states to establish ‘regulations and requirements for protecting the confidentiality of sensitive information and for protecting information assets’ as a fundamental part of the ‘legislative and regulatory framework, and associated administrative measures, to govern the nuclear security regime’.
Too often nuclear security, including information sharing, is regarded as a sovereign matter leading to varying standards. Nevertheleses, beyond initiatives at individual states or their licensees, there has been an increased focus on ‘bottom up’ approaches within the nuclear industry to garner shared understandings. For example, non-binding industry codes of conduct seek to balance academic freedoms with the need for greater information security, while organisations such as the International Nuclear Security Education Network (INSEN) and the World Institute for Nuclear Security (WINS) seek to provide spaces for training and discussion.
Further Reading:
