IR 05000263/2022401

Generation Plant - Cyber Security Inspection Report 05000263/2022401

ML22083A184
Person / Time
Site:	Monticello
Issue date:	03/28/2022
From:	Richard Skokowski Engineering Branch 3
To:	Domingos C Northern States Power Company, Minnesota
References
IR 2022401
Download: ML22083A184 (9)

Text

March 28, 2022

SUBJECT:

MONTICELLO NUCLEAR GENERATING PLANT-CYBER SECURITY INSPECTION REPORT 05000263/2022401

Dear Mr. Domingos:

On February 22, 2022, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Monticello Nuclear Generating Plant and discussed the results of this inspection with Mr. K. Nyberg, Director of Site Performance and Support and other members of your staff.

The results of this inspection are documented in the enclosed report.

No findings or violations of more than minor significance were identified during this inspection.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely, Signed by Skokowski, Richard on 03/28/22 Richard A. Skokowski, Chief Engineering Branch 3 Division of Reactor Safety Docket No. 05000263 License No. DPR-22

Enclosure:

As stated

Inspection Report

Docket Number: 05000263 License Number: DPR-22 Report Number: 05000263/2022401 Enterprise Identifier: I-2022-401-0023 Licensee: Northern States Power Company, Minnesota Facility: Monticello Nuclear Generating Plant Location: Monticello, MN Inspection Dates: February 14, 2022 to February 18, 2022 Inspectors: A. Dahbur, Senior Reactor Inspector J. Gilliam, Senior Reactor Inspector A. Prada, Cyber Security Analyst (Contractor)

C. Priester, Cyber Security Analyst (Contractor)

Approved By: Richard A. Skokowski, Chief Engineering Branch 3 Division of Reactor Safety Enclosure

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a cyber security inspection at Monticello Nuclear Generating Plant, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

No findings or violations of more than minor significance were identified.

Additional Tracking Items

None.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2201, Security Inspection Program for Commercial Nuclear Power Reactors. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

71130.10 - Cybersecurity

The inspectors reviewed implementation of Monticello Generating Plants Cyber Security Plan (CSP) and focused on evaluating changes to the program, critical systems, and Critical

===Digital Assets (CDAs).

Cybersecurity (1 Sample)===

(1) The following IP sections were completed and constitute completion of 1 sample:

- 03.01, Review Ongoing Monitoring and Assessment Activities

- 03.02, Verify Defense-in-Depth Protective Strategies

- 03.03, Review of Configuration Management Change Control

- 03.04, Review of Cyber Security Program

- 03.05, Evaluation of Corrective Actions In addition to the systems and programs that have been added or modified since the last cyber security inspection, the following systems were selected for inspection.

Unit 1

- CMP- Computer, Important-to-Safety

- HPC- High Pressure Coolant Injection, Safety-Related

- SIN- Security Instrumentation, Security

- SEL- Security Facility Electrical, Security

INSPECTION RESULTS

No findings were identified.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

On February 22, 2022, the inspectors presented the cyber security inspection results to Mr. K. Nyberg, Director of Site Performance and Support and other members of the licensee staff.

DOCUMENTS REVIEWED

Inspection Type Designation Description or Title Revision or

Procedure Date

71130.10 Corrective Action 01000060470 Acronis Backups on the Security Computer System 02/10/2022

Documents 501000003112 Cyber Kiosk Defense-in-Depth 09/27/2017

501000003132 CDA Media Sanitization 09/08/2017

501000015940 Wrong Level CDA Media 09/20/2018

501000030162 Media Cabinet Unlocked 07/29/2019

501000030182 Feeder Motor Protection Relay Missing 07/30/2019

501000041636 CSAT Evaluation of X-Ray 06/17/2020

501000058604 Unauthorized USB Media Used on CDA 11/23/2021

501000058844 FSA Cyber21-Review SecCompRm Door Access 12/06/2021

501000058971 Corrective Action: Cyber Security Vulnerabilities 2021-11 12/10/2021

501000058971 Condition Evaluation - November 2021 Vulnerabilities 01/06/2022

501000059900 Condition Evaluation - December 2021 Vulnerabilities 01/26/2022

501000060137 Spare HGU Order Cancelled 01/27/2022

Corrective Action 501000060470 22Cyber - Security Computer Backups 02/11/2022

Documents 501000060567 22Cyber - MM WO Lacking Parts Info 02/15/2022

Resulting from 501000060600 22Cyber - Acronis Backup Version on SCS 02/15/2022

Inspection 501000060601 22Cyber - CP-FWL-07 CDA Assessment 02/15/2022

501000060668 22Cyber - CP-FWL-07 Control D4.3 02/17/2022

501000060669 22Cyber - CAS Printer Control D5.1 02/17/2022

Drawings M-124 NH-36250 High Pressure Coolant Injection System 87

NX-8292-12-6 Shutdown HPCI System 79

Miscellaneous 1400858 AT-0175 Action Request Record Report - CYB SEC PLAN 10/09/2016

D4.3 PASSWORD REQUIRMENTS

1401049 AT-0175 Action Request Record Report - CYB SEC PLAN 11/23/2016

D4.7 AUTHENTICATOR MGMT

CASF DEV FEL- Compliance Assessment Summary Form - Generator 1

MISC Electrical

CASF DEV SEL- Compliance Assessment Summary Form - Hand Geometry 0

HGU Units

CASF DEV SIN- Compliance Assessment Summary Form - Alarm Processing 0

APU-20180406 Units

Inspection Type Designation Description or Title Revision or

Procedure Date

CASF DEV SIN- Compliance Assessment Summary Form - CCTV Cameras 3

CAMERA-

210618

CASF DEV SIN- Compliance Assessment Summary Form - Proximity Card 0

CRDR-20150527 Readers

CASF DEV SIN- Compliance Assessment Summary Form - Security 3

IMUX-20210326 Multiplexer

CASF DEV SIN- Compliance Assessment Summary Form - Keyboard Video 0

KVM-20170911 Mouse Switch

CASF DEV SIN- Compliance Assessment Summary Form - Security Network 2

NS-20181112 Switches

CASF DEV SIN- Compliance Assessment Summary Form - Security 2

PC-20210504 Workstations

CASF DEV SIN- Compliance Assessment Summary Form - Security 2

SVR-20181112 Computer System Servers

CASF DEV SIN- Compliance Assessment Summary Form - CCTV Video 1

VIDEO-20190111 Equipment

CASF DEV-SIN- Compliance Assessment Summary Form - Intrusion 0

CYBER- Prevention / SIEM / NAS

20150916

Cyber Security Letter from Rockwell Collins 11/27/2017

Test Description

FAT SCS-

CSTDF-202734

Addendum

Cyber Security AIM Security Computer Cyber Security Test Description July 2014

Test Description (FAT)

FAT SCS-

CSTDF-

2734.01

CYBER-PLN Xcel Energy, INC. Cyber Security Plan 0

PBD-KIOSK Cyber Security Program Basis Document 2

SCS-CSTDF Security Computer System Hardening 07/01/2014

2734.01

Inspection Type Designation Description or Title Revision or

Procedure Date

SCS-VDD- Rockwell Collins Version Description Document 8

203217.08

Switch Config Switch Configurations of NS1 & NS2 02/15/2022

Procedures C.5-3302 Alternate Pressure Control 25

FG-IT-CSP-06-02 IT Cyber Administrative Maintenance Guide for Kiosk 3

FP-IT-CSP-05 Cyber Security Audit and Logging Procedure 2

FP-IT-CSP-06 Cyber Security Malicious Code Protection Procedure 7

FP-IT-CSP-07 Cyber Security Portable Computing Device Procedure 6

FP-IT-CSP-11 Cyber Security Incident and Response Procedure 5

FP-IT-CSP-16 Cyber Security Program Training Procedure 5

FP-IT-CSP-21 Cyber Security CDA Media Protection Procedure 6

FP-IT-CSP-22 Cyber Security Vulnerability Assessment Procedure 0

FP-IT-CSP-24 Cyber Security Ongoing Monitoring Procedure 0

FP-IT-CSP-25 Cyber Security CDA Management Procedure 5

FP-IT-CSP-31 Cyber Security Incident Response Exercise / Drill Procedure 1

FP-IT-CSP-65 Cyber Security CDA Access Control Procedure 1

FP-IT-SQA-01 Software Quality Assurance (SQA) Program 20

FP-IT-SQA-05 Computer Work Order 16

FP-IT-SQA-10 The Software Testing Phase 11

FP-SC-GEN-08 Supply Chain Requests 21

FP-SC-WHS-07 Material Control 1

Work Orders CWO- Computer Work Order - Implement SCS Final Configuration 03/27/2018

611000000786

CWO- Computer Work Order 16

611000001953

CWO- Computer Work Order 16

611000002133

CWO- Computer Work Order - SCS VMWare Upgrade 02/25/2021

611000003181

CWO- Monthly OCA Camera Cyber Maintenance 09/29/2021

611000003610

CWO- Monthly OCA Camera Cyber Maintenance 11/24/2021

611000003618

Inspection Type Designation Description or Title Revision or

Procedure Date

CWO- Metadefender Core 12/21/2021

611000003716

CWO- Metadefender Core 01/04/2022

611000003728

CWO-SCS Computer Work Order - Service Pack 5 (SP5) 07/01/2019

611000001974 Implementation

Service Pack 5

_SP5_

Implementation

WM-WO-0156 Noble Gas Monitor Work Order 04/23/2020

WO-00494225 EC22668 Security Card Reader / IMUX Replacement 09/03/2014

Task 07

7