Comment on FR Doc # 2026-12989, NRC-2025-1303-0001, from Anonymous

Recommendation: The NRC should remove prescriptive timeline calculations from the regulation and associated guidance and instead rely on performance-based validation through force-on-force (FOF) exercises, tactical response drills, and target set performance evaluations. The purpose of a protective strategy is to demonstrate that the security organization can successfully prevent radiological sabotage under realistic conditions. Whether an operator action, security response, or defensive strategy is achievable is ultimately determined through actual performance, not through a theoretical timeline calculation. A mathematical timeline assessment is only a prediction of performance, whereas force-on-force exercises provide direct evidence of performance. If a timeline overestimates the capability of responders or operators, the deficiency will become evident during performance-based evaluations. In such cases, the adversary will successfully accomplish the objective before the credited protective action is completed, demonstrating that the strategy is not effective. Conversely, if security personnel and operators successfully perform the required actions during force-on-force exercises and drills, the strategy has been validated through actual execution rather than a theoretical analysis. The current approach creates redundancy by requiring both: 1.A prescriptive analytical demonstration that the timeline is achievable; and 2.A performance demonstration through drills and exercises that inherently validates the same assumption. From a risk-informed perspective, the regulatory focus should remain on outcomes rather than on the specific analytical methods used to predict those outcomes. The performance program already provides an objective measure of success or failure. A protective strategy either prevents target set destruction or it does not. Additional regulatory requirements for detailed timeline calculations do not improve security effectiveness when the strategy is already subject to periodic performance testing under realistic adversary conditions. Furthermore, timeline calculations are inherently dependent on assumptions regarding adversary actions, environmental conditions, communications, decision-making, travel times, and human performance. These assumptions can never fully replicate actual battlefield conditions present during a force-on-force exercise. Performance testing provides a more realistic and defensible measure of effectiveness because it incorporates the complexities, uncertainties, and human factors that cannot be fully captured in a mathematical model. A more risk-informed and performance-based approach would allow licensees flexibility in how they validate protective strategies while maintaining accountability through demonstration of successful performance. This approach would reduce unnecessary analytical burden and align with the NRC's stated objective of modernizing security requirements by focusing on demonstrated capability rather than prescriptive calculations. In summary, force-on-force evaluations already answer the fundamental regulatory question: Can the security organization and operators successfully implement the protective strategy before the adversary achieves their objective? If the answer is yes, the timeline has been validated. If the answer is no, the strategy requires improvement. Requiring a separate regulatory timeline calculation therefore provides limited additional safety or security value and is redundant to the existing performance-based security program.