Civil Nuclear Security Governance Frameworks

1. Introduction

Civil nuclear security governance refers to the legal and institutional system used to protect nuclear facilities, nuclear materials, radioactive substances, sensitive information and nuclear-related technology from theft, sabotage, terrorism, unauthorised access and other security threats.

Nuclear security is different from nuclear safety. Safety mainly concerns accidental events, such as equipment failure or human error. Security focuses on intentional or hostile acts. Modern governance therefore combines physical protection, personnel security, transport security, cybersecurity, information protection, emergency preparedness and international cooperation.

The International Atomic Energy Agency (IAEA) describes the international framework as including the Convention on the Physical Protection of Nuclear Material (CPPNM) and its 2005 Amendment. The Amendment expanded the Convention to nuclear material and facilities used for peaceful purposes in domestic use, storage and transport, and to protection against sabotage. (Office for Nuclear Regulation)

2. Main Objectives

A civil nuclear security framework generally has five objectives:

preventing theft or unauthorised removal of nuclear material;

preventing sabotage of nuclear facilities;

protecting sensitive nuclear information;

preventing unauthorised access to nuclear facilities and systems; and

ensuring an effective response when a security incident occurs.

The framework therefore operates throughout the nuclear lifecycle—from design and construction to operation, transport, storage and decommissioning.

3. Regulatory Institutions

Effective nuclear security requires a strong and independent regulator. In the United Kingdom, the Office for Nuclear Regulation (ONR) is responsible for approving security arrangements in the civil nuclear industry and enforcing compliance.

Its responsibilities cover physical protection, personnel security, transport security, cybersecurity and information assurance. It also regulates nuclear material during domestic transport and certain international transport involving UK-flagged vessels. (Office for Nuclear Regulation)

In South Africa, the National Nuclear Regulator (NNR) was established under the National Nuclear Regulator Act 47 of 1999. The Act provides for regulation of nuclear activities and protection of people, property and the environment against nuclear damage. (Government of South Africa)

The South African framework also emphasises co-operative governance between state institutions dealing with radioactive material and ionising radiation. (Law Library)

4. Physical Security

Physical protection is the traditional foundation of nuclear security. Operators must control access to nuclear sites, protect important equipment and nuclear material, monitor sensitive areas and maintain arrangements for responding to attempted intrusion or sabotage.

In the UK, the Nuclear Industries Security Regulations 2003 (NISR) require civil nuclear operators to establish and maintain security arrangements. Operators must prepare approved Nuclear Site Security Plans, while ONR evaluates their adequacy. (Office for Nuclear Regulation)

The regulator can also issue directions requiring responsible persons to adopt particular security arrangements or submit revised security plans. (Office for Nuclear Regulation)

5. Personnel Security

Nuclear security depends not only on fences and technology but also on people. Employees and contractors may have access to sensitive facilities, material or information.

Consequently, governance frameworks include pre-employment screening, security vetting, continuing personnel controls and workforce trustworthiness.

The UK's Security Assessment Principles specifically identify workforce trustworthiness, human performance and organisational security culture as important regulatory principles. (Office for Nuclear Regulation)

6. Cybersecurity and Sensitive Information

Modern nuclear facilities depend heavily on digital systems. A cyberattack could potentially interfere with control systems, communications, physical security or safety-related functions.

Therefore, contemporary nuclear-security governance includes cybersecurity and information assurance. UK Security Assessment Principles expressly treat cybersecurity as one of the security disciplines assessed by ONR. (Office for Nuclear Regulation)

Sensitive Nuclear Information is also protected under the NISR framework. Organisations handling such information in the supply chain may become regulated dutyholders and must maintain arrangements to minimise risks of loss, theft, unauthorised disclosure or access. (Office for Nuclear Regulation)

7. Transport Security

Nuclear security does not stop at the nuclear site. Nuclear and radioactive materials may be transported by road, rail or sea.

The UK framework therefore combines the NISR 2003, dangerous-goods legislation and ionising-radiation regulations for transport security. Operators must maintain security arrangements proportionate to the material and risk involved. (Office for Nuclear Regulation)

8. Case Law

Direct judicial decisions dealing with detailed nuclear-security arrangements are relatively limited because security information is often confidential or classified. Courts therefore tend to address nuclear governance through broader principles of administrative law, environmental law, licensing and regulatory accountability.

In R (Greenpeace Ltd) v Secretary of State for Trade and Industry [2007] EWHC 311 (Admin), the High Court examined the government's decision-making process concerning the future of nuclear power. The case is relevant because it demonstrates that major nuclear policy decisions remain subject to requirements of lawful and proper governmental decision-making.

In Earthlife Africa Johannesburg v Minister of Environmental Affairs 2017 (2) SA 519 (SCA), the South African Supreme Court of Appeal held that climate-change impacts had to be properly considered in environmental decision-making concerning a proposed coal-fired power station. Although this was not a nuclear-security case, it demonstrates the broader principle that major energy infrastructure decisions must comply with applicable environmental and administrative requirements.

Similarly, Maccsand (Pty) Ltd v City of Cape Town 2012 (4) SA 181 (CC) illustrates that compliance with one regulatory system does not automatically eliminate obligations under another. This principle is relevant to nuclear projects because nuclear operators may simultaneously face nuclear, environmental, land-use, cybersecurity and emergency-management requirements.

9. International Cooperation

Nuclear security cannot be managed by one country alone. Nuclear materials and technology can cross national borders, while terrorism and cyber threats are transnational.

The CPPNM and its Amendment therefore require states to establish physical protection arrangements, criminalise certain nuclear-security offences and cooperate internationally in cases involving sabotage or other serious security incidents. (Office for Nuclear Regulation)

Conclusion

Civil nuclear security governance is a multi-layered regulatory framework combining physical protection, personnel vetting, transport controls, cybersecurity, information protection, emergency response, licensing and international cooperation.

The modern approach is increasingly risk-based and outcome-focused, rather than relying only on fixed technical rules. The UK's Security Assessment Principles illustrate this approach by covering physical, personnel, transport, cyber and information-security disciplines. (Office for Nuclear Regulation)

The central legal principle is that nuclear operators and regulators must maintain security arrangements capable of protecting the public, nuclear materials and critical infrastructure against intentional threats, while government institutions must provide effective oversight, accountability and international cooperation.