IR 05000254/2013408

IR 05000254-13-408, 05000265-13-408, 11/22/2013, Quad Cities Nuclear Power Station, Units 1 & 2, Inspection of Temporary Instruction 2201-004, Inspection of Implementation of Interim Cyber Security Milestones 1-7

ML14051A720
Person / Time
Site:	Quad Cities
Issue date:	02/20/2014
From:	Robert Daley Engineering Branch 3
To:	Pacilio M Exelon Generation Co, Exelon Nuclear
Gregory Hansen
References
IR-13-408
Download: ML14051A720 (4)

Text

UNITED STATES uary 20, 2014

SUBJECT:

QUAD CITIES NUCLEAR POWER STATION, UNITS 1 AND 2 INSPECTION OF TEMPORARY INSTRUCTION 2201/004, INSPECTION OF IMPLEMENTATION OF INTERIM CYBER SECURITY MILESTONES 1 - 7 INSPECTION REPORT 05000254/2013408; 05000265/2013408

Dear Mr. Pacilio:

On November 22, 2013, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Quad Cities Nuclear Power Station, Units 1 and 2. The inspection covered the interim Cyber Security Milestones 1 - 7 of the security cornerstone. The enclosed inspection report documents the inspection results, which were discussed on January 24, 2014, with Mr. Joseph Taft and other members of your staff.

The inspection examined activities conducted under your license as they relate to cyber security and compliance with the Commissions rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Two NRC-identified findings of very low significance (Green) were identified during this inspection. The findings were determined to involve violations of NRC requirements. Further, licensee-identified violations which were determined to be of very low significance (Green) are listed in Section 4OA7 of this report. The NRC is treating these violations as Non-Cited Violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy. These issues were discussed and reviewed during the Security Issues Forum (SIF) Meeting conducted on December 18, 2013. The results of the SIF Panel review concluded that although these issues constituted violations of your facility operating license (FOL) and Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, Protection of Digital Computer and Communication Systems and Networks, the NRC is exercising enforcement discretion.

Enclosure contains Sensitive Unclassified Non-Safeguards Information. When separated from enclosure, this transmittal document is decontrolled. The NRC is not taking enforcement action for these violations because they meet the criteria established in an NRC Memorandum from Barry C. Westreich, Director, Cyber Security Directorate, Office of Nuclear Security, and Incident Response, to each regional office and Director, Division of Reactor Safety, Subject: Enhanced Guidance for Licensee Near-Term Corrective Actions to Address Cyber Security Inspection Findings and Licensee Eligibility for Good-Faith Attempt Discretion dated July 1, 2013, (ADAMS Accession Number ML13178A203).

Consistent with the NRC Memorandum, upon completion of all corrective actions, you are requested to provide written notification to the NRCs Regional Office as to the method and date of closure for the identified issue(s).

In accordance with Title 10, Code of Federal Regulations (CFR), Section 2.390 of the NRC's

"Rules of Practice," a copy of this letter will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). However, the material enclosed herewith contains Security-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRC's ADAMS. If you choose to provide a response and Security-Related Information is necessary to provide an acceptable response, please mark your entire response Security-Related Information - Withhold Under 10 CFR 2.390 in accordance with 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390(b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response.

Sincerely,

/RA/

Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket No(s).: 50-254; 50-265 License No(s).: DPR-29; DPR-30 Nonpublic Enclosure:

Inspection Report 05000254/2013408; 05000265/2013408 w/Attachment: Supplemental Information cc w/o enclosure: Distribution via ListServ'