|
---|
Category:Inspection Plan
MONTHYEARML24026A0532024-01-30030 January 2024 Notification of an NRC Fire Protection Team Inspection- (Report 05000348/2024011, 05000364/2024011) and Request for Information ML23335A0122023-12-0101 December 2023 FNP - IP95001 Inspection Notification and Request for Information (Email to Farley) ML23335A0112023-12-0101 December 2023 IP 95001 Inspection Notification and Request for Information (EA-23-080) IR 05000348/20220062023-03-0101 March 2023 Annual Assessment Letter for Joseph M. Farley Nuclear Plant, Units 1 and 2 Report 05000348/2022006 and 05000364/2022006 ML22347A0882022-12-13013 December 2022 Final Farley Pi_R Initial RFI (2023) IR 05000348/20220052022-08-24024 August 2022 Updated Inspection Plan for Joseph M. Farley Nuclear Plant, Units 1 and 2 - Report 05000348/2022005 and 05000364/2022005 ML22229A4792022-08-15015 August 2022 HP Baseline Inspection Document Request ML22101A2862022-04-0101 April 2022 RQ Inspection Corporate Notification Letter IR 05000348/20210062022-03-0202 March 2022 Annual Assessment Letter for Joseph M. Farley Nuclear Plant Units 1 and 2 (Report No. 05000348/2021006 and 05000364/2021006) IR 05000348/20210052021-08-24024 August 2021 Updated Inspection Plan for Joseph M. Farley Nuclear Plant Units 1 and 2 (Report 05000348/2021005 and 05000364/2021005) ML20302A0002020-10-28028 October 2020 Notification of Inspection and Request for Information for NRC Problem Identification and Resolution Inspection ML20254A1912020-09-10010 September 2020 004 Radiation Safety Baseline Inspection Information Request ML20175A1992020-06-23023 June 2020 Emergency Preparedness Program Inspection Request for Information ML20094H5182020-04-0303 April 2020 Plant Reference Simulator Inspection Request for Information IR 05000348/20190062020-03-0303 March 2020 Annual Assessment Letter for Joseph M. Farley Nuclear Plant - Report 05000348/2019006 and 05000364/2019006 ML19274D2092019-09-23023 September 2019 ISI Request for Information IR 05000348/20190052019-08-28028 August 2019 Updated Inspection Plan for Joseph M. Farley Nuclear Plant Reports 05000348/2019005 and 05000364/2019005 IR 05000348/20190132019-04-10010 April 2019 Information Request for the Cyber-Security Baseline Security Inspection, Notification to Perform Inspection 05000348/2019013; 05000364/201901 ML19100A0072019-04-10010 April 2019 Information Request for the Cyber-Security Baseline Security Inspection, Notification to Perform Inspection 05000348/2019013; 05000364/201901 IR 05000364/20180062019-03-0404 March 2019 Annual Assessment Letter for Joseph M. Farley Nuclear Plant - Report 05000346 and 05000364/2018006 ML19063B8902019-03-0404 March 2019 ISI Sgisi 2019002 RFI - Bcc ML19052A1712019-02-20020 February 2019 Rad Safety Inspection Document Request ML18360A2312018-12-21021 December 2018 Notification of Inspection and Request for Information for Nuclear Regulatory Commission Problem Identification and Resolution Inspection IR 05000348/20180052018-08-23023 August 2018 Updated Inspection Plan for Joseph M. Farley Nuclear Plant Units 1 and 2 - NRC Inspection Reports 05000348/2018005 and 05000364/2018005 ML18094A7822018-04-0303 April 2018 Notification of Conduct of a Triennial Fire Protection Baseline Inspection - U.S. Nuclear Regulatory Commission Inspection Report Nos. 05000348/2018011 and 05000364/2018011 ML18059A1532018-02-28028 February 2018 EOC Assessment Letter ML18058B1522018-02-27027 February 2018 Emailed RP RFI 2018-02 ML18053A0942018-02-22022 February 2018 Baseline In-Service Inspection Initial Information Request ISI 2018002 Rpc IR 05000348/20170052017-08-28028 August 2017 Updated Inspection Plan for Joseph M. Farley Nuclear Plant, Units 1 and 2, NRC Report 05000348/2017005 and 05000364/2017005 ML17156A1032017-06-0202 June 2017 Notification of Inspection and Request for Information IR 05000348/20160062017-03-0101 March 2017 Annual Assessment Letter for Joseph M. Farley Nuclear Plant Units 1 and 2 (Report 05000348/2016006 and 05000364/2016006) IR 05000348/20160052016-08-31031 August 2016 Mid-Cycle Assessment Letter for Joseph M. Farley Nuclear Plant Units 1 and 2 - NRC Inspection Report 05000348/2016005 and 05000364/2016005 ML16244A3102016-08-29029 August 2016 Notification of Inspection and Request for Information ML16062A1522016-03-0202 March 2016 Final Annual Assessment Letter ML15260A9022015-09-17017 September 2015 Notification of Inspection and Request for Information for NRC Problem Identification and Resolution Inspection IR 05000348/20150052015-09-0101 September 2015 Mid-Cycle Assessment Letter for Joseph M. Farley Nuclear Plant Unit 1 and Unit 2 (NRC Inspection Report 05000348/2015005 and 05000364/2015005) ML14245A1752014-09-0202 September 2014 Mid-cycle Ltr 2014 ML14121A5042014-05-0101 May 2014 Notification of Triennial Fire Protection Baseline Inspection and Request for Information IR 050000348-14-009 and 05000364-14-009 IR 05000348/20140012014-03-0404 March 2014 Annual Assessment Letter for Joseph M. Farley Nuclear Plant Unit 1 and Unit 2 (NRC Inspection Report 05000348/2014001 and 05000364/2014001) ML14063A1442014-03-0404 March 2014 2013 Annual Assessment Letter for Joseph M. Farley Nuclear Plant, Units 1 and 2 ML13354B9722013-12-20020 December 2013 Notification of Joseph M. Farley Nuclear Plant, Units 1 and 2 Component Design Bases Inspection - NRC Inspection Report 05000348-14-007, 05000364-14-007 ML13253A3662013-09-10010 September 2013 Notification of Inspection and Request for Information for NRC Problem Identification and Resolution Inspection ML13246A1102013-09-0303 September 2013 Mid-Cycle Assessment Letter ML13070A4622013-03-0808 March 2013 Notification of Inspection and Request for Information IR 05000348/20120012013-03-0404 March 2013 Annual Assessment Letter for Joseph M. Farley Nuclear Plant Unit 1 and Unit 2 (NRC Inspection Report 05000348/2012001 and 364/2012001) ML13015A3652013-01-15015 January 2013 Emerg Prep Insp and RFI for 2-18-2013 ML12248A0472012-09-0404 September 2012 Mid Cycle Assessment Letter Farley 2012 ML1124401732011-09-0101 September 2011 Report 22 - Farley ML1106301482011-03-0404 March 2011 Report 22, Inspection/Activity Plan 01/01/2011 - 06/30/2012 ML1024407102010-09-0101 September 2010 Report 22 2024-01-30
[Table view] Category:Letter
MONTHYEARML24010A0032024-01-30030 January 2024 Exemption from Select Requirements of 10 CFR Part 73 - Security Notifications, Reports, and Recordkeeping and Suspicious Activity Reporting ML24026A0532024-01-30030 January 2024 Notification of an NRC Fire Protection Team Inspection- (Report 05000348/2024011, 05000364/2024011) and Request for Information IR 05000348/20230402024-01-24024 January 2024 95001 Supplemental Inspection Report 05000348/2023040 and Follow-Up Assessment Letter ML23341A2042024-01-12012 January 2024 Request for Additional Information Exemption Requests for Physical Barriers (EPID L-2023-LLE-0018 & L-2023-LLE-0021) NL-24-0011, Report of Changes to Emergency Plan and Summary of 50.54(q) Analysis2024-01-11011 January 2024 Report of Changes to Emergency Plan and Summary of 50.54(q) Analysis ML23345A1312024-01-0303 January 2024 Withholding Letter - SNC Fleet - Physical Barriers Exemption (L-2023-LLE-0018 and L-2023-LLE-0021) ML23346A2222023-12-22022 December 2023 Transmittal of Dam Inspection Report - Public NL-23-0901, 30-Day 10 CFR 21 Notification - Framatome Supplied Siemens Medium Voltage (Mv) Circuit Breakers2023-12-15015 December 2023 30-Day 10 CFR 21 Notification - Framatome Supplied Siemens Medium Voltage (Mv) Circuit Breakers NL-23-0908, Cycle 30 Core Operating Limits Report2023-12-13013 December 2023 Cycle 30 Core Operating Limits Report NL-23-0877, Request for Exemption from Security Event Notification Implementation2023-11-29029 November 2023 Request for Exemption from Security Event Notification Implementation ML23228A1432023-11-22022 November 2023 Issuance of Amendment Nos. 249 and 246 to Revise TS 3.6.3, Surveillance Requirement 3.6.3.5 to Eliminate Event-Based Testing of Containment Purge Valves with Resilient Seals NL-23-0825, Reply to Notice of Violation EA-23-080 and Readiness for 95001 Inspection2023-11-14014 November 2023 Reply to Notice of Violation EA-23-080 and Readiness for 95001 Inspection ML23318A0672023-10-31031 October 2023 1 to Updated Final Safety Analysis Report, Updated NFPA 805 Fire Protection Program Design Basis Document, Technical Specification Bases Changes, Technical Requirements Manual Changes, IR 05000348/20230032023-10-24024 October 2023 Integrated Inspection Report 05000348/2023003 and 05000364/2023003 IR 05000348/20230912023-10-19019 October 2023 Final Significance Determination of a White Finding and Notice of Violation and Assessment Followup Letter NRC Inspection Report 05000348/2023091 IR 05000348/20234022023-10-18018 October 2023 Security Baseline Inspection Report 05000348/2023402 and 05000364/2023402 IR 05000348/20234412023-10-12012 October 2023 Supplemental Inspection Report 05000348/2023441 and 05000364/2023441 and Follow-Up Assessment Letter (Cover Letter) ML23241B0212023-09-12012 September 2023 Review of Quality Assurance Topical Report NL-23-0739, Response to NRC Inspection Report and Preliminary White Finding2023-09-0808 September 2023 Response to NRC Inspection Report and Preliminary White Finding IR 05000348/20230902023-08-31031 August 2023 NRC Inspection Report 05000348/2023090 and Preliminary White Finding and Apparent Violation ML23164A1202023-08-30030 August 2023 Proposed Inservice Inspection Alternative FNP-ISI-ALT-05-05, Version 1.0, to the Requirements of the ASME Code ML23240A0012023-08-30030 August 2023 Correction to Issuance of Amendment Nos. 241, 242, 243, and 244 ML23235A2962023-08-24024 August 2023 Issuance of Amendment Nos. 247 and 244, Regarding License Amendment Request to Revise Technical Specification 3.6.5, Containment Air Temperature, (EPID L-2023-LLA-0116) (Emergency Circumstances) NL-23-0716, Response to Request for Additional Information Regarding Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit2023-08-23023 August 2023 Response to Request for Additional Information Regarding Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit NL-23-0713, Response to Request for Additional Information Regarding Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit2023-08-23023 August 2023 Response to Request for Additional Information Regarding Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit NL-23-0704, Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit2023-08-22022 August 2023 Emergency License Amendment Request: Technical Specification 3.6.5, Containment Air Temperature, One-Time Temporary Change to Limit IR 05000348/20330012023-08-14014 August 2023 NRC Operator License Examination Report 05000348/203301 and 05000364/2023302 NL-23-0658, Southern Nuclear Operating Company - Response to Request for Additional Information Regarding Quality Assurance Topical Report Submittal2023-08-11011 August 2023 Southern Nuclear Operating Company - Response to Request for Additional Information Regarding Quality Assurance Topical Report Submittal IR 05000348/20230022023-08-10010 August 2023 Integrated Inspection Report 05000348/2023002 and 05000364/2023002, and Apparent Violation ML23221A3062023-08-0909 August 2023 Notification of NRC Supplemental Inspection (95002) and Request for Information (Cover Letter) NL-23-0542, CFR 50.46 ECCS Evaluation Model Annual Report for 20222023-08-0909 August 2023 CFR 50.46 ECCS Evaluation Model Annual Report for 2022 NL-23-0624, Report of Changes to Emergency Plan and Summary of 50.54(q) Analysis2023-08-0404 August 2023 Report of Changes to Emergency Plan and Summary of 50.54(q) Analysis ML23202A1122023-08-0202 August 2023 Units, 1 and 2; and Vogtle Units 1 and 2 - Request to Use a Provision of a Later Edition of the American Society of Mechanical Engineers Boiler and Pressure Vessel Code, Section XI NL-23-0628, Readiness for Supplemental Inspection EA-22-1012023-07-26026 July 2023 Readiness for Supplemental Inspection EA-22-101 NL-23-0566, ISFSI and Edwin I. Hatch Nuclear Plant ISFSI - Registration of Spent Fuel Cask Use2023-07-13013 July 2023 ISFSI and Edwin I. Hatch Nuclear Plant ISFSI - Registration of Spent Fuel Cask Use NL-23-0555, Request for Exemption from Physical Barrier Requirement2023-07-0707 July 2023 Request for Exemption from Physical Barrier Requirement NL-23-0506, to Non-Voluntary License Amendment Request: Technical Specification Revision to Adopt WCAP-17661-P-A, Improved RAOC and CAOC Fq Surveillance Technical Specifications2023-07-0505 July 2023 to Non-Voluntary License Amendment Request: Technical Specification Revision to Adopt WCAP-17661-P-A, Improved RAOC and CAOC Fq Surveillance Technical Specifications ML23136B1542023-07-0303 July 2023 Issuance of Amendment Nos. 246 & 243, Regarding License Amendment Request to Revise Technical Specification 4.3, Fuel Storage, to Correct Tabulated Values from the Associated Spent Fuel Pool (SFP) Criticality Analysis IR 05000348/20230102023-06-29029 June 2023 Comprehensive Engineering Team Inspection (CETI) Baseline Inspection Report 05000348/2023010 and 05000364/2023010 NL-23-0444, Quality Assurance Topical Report Submittal2023-06-15015 June 2023 Quality Assurance Topical Report Submittal ML23164A2182023-06-14014 June 2023 Draft Safety Evaluation for License Amendment Request to Revise Technical Specification 4.3, Fuel Storage, to Correct Tabulated Values from the Associated SFP Criticality Analysis (EPID L-2022-LLA-0138) - Letter NL-23-0457, ISFSI, and Edwin I. Hatch Nuclear Plant, ISFSI - Registration of Spent Fuel Cask Use2023-06-12012 June 2023 ISFSI, and Edwin I. Hatch Nuclear Plant, ISFSI - Registration of Spent Fuel Cask Use NL-23-0449, National Pollutant Discharge Elimination System (NPDES) Permit Renewal Application2023-06-0202 June 2023 National Pollutant Discharge Elimination System (NPDES) Permit Renewal Application NL-23-0383, SNC Response to Regulatory Issue Summary 2023-01:Preparation And.2023-05-19019 May 2023 SNC Response to Regulatory Issue Summary 2023-01:Preparation And. NL-23-0372, Units 1 & 2, Joseph M. Farley Nuclear Plant - Units 1 & 2, Vogtle Electric Generating Plant - Units 1 & 2, Annual Radiological Environmental Operating Reports for 20222023-05-10010 May 2023 Units 1 & 2, Joseph M. Farley Nuclear Plant - Units 1 & 2, Vogtle Electric Generating Plant - Units 1 & 2, Annual Radiological Environmental Operating Reports for 2022 NL-23-0337, Response to Request for Additional Information Related to License Amendment Request to Revise the Frequency of Surveillance Requirement 3.6.3.52023-05-0505 May 2023 Response to Request for Additional Information Related to License Amendment Request to Revise the Frequency of Surveillance Requirement 3.6.3.5 IR 05000348/20234402023-05-0505 May 2023 Reissue Farley Units-Final Significance Determination for a Security-Related Greater than Green Finding, Nov and Assessment Followup LTR, IR 05000348/2023440 and 05000364/2023440 - Cover IR 05000348/20230012023-05-0404 May 2023 Integrated Inspection Report 05000348/2023001 and 05000364/2023001 NL-23-0295, Reply to a Notice of Violation; EA-22-1012023-05-0101 May 2023 Reply to a Notice of Violation; EA-22-101 NL-23-0310, Annual Non-Radiological Environmental Operating Reports and Annual Radioactive Effluent Release Reports for 20222023-04-25025 April 2023 Annual Non-Radiological Environmental Operating Reports and Annual Radioactive Effluent Release Reports for 2022 2024-01-30
[Table view] |
Inspection Report - Farley - 2019013 |
---|
|
|
Text
UNITED STATES April 10, 2019
SUBJECT:
JOSEPH M. FARLEY NUCLEAR PLANT - INFORMATION REQUEST FOR THE CYBER-SECURITY BASELINE SECURITY INSPECTION, NOTIFICATION TO PERFORM INSPECTION 05000348/2019013; 05000364/2019013
Dear Mr. Kharrl:
On August 12, 2019, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline inspection in accordance with Inspection Procedure (IP) 71130.10P Cyber-Security, Revision 0 at Farley Nuclear Plant, Units 1 and 2. The inspection will be performed to evaluate and verify your ability to meet the Milestone 8 (i.e., full implementation) requirements of the NRCs Cyber-Security Rule, Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, Protection of Digital Computer and Communication Systems and Networks. The onsite portion of the inspection will take place during the weeks of August 12, 2019, and August 26, 2019.
Experience has shown that baseline inspections are extremely resource intensive, both for the NRC inspectors and the licensee staff. In order to minimize the inspection impact on the site and to ensure a productive inspection for both parties, we have enclosed a request for documents needed for the inspection. These documents have been divided into four groups.
The first group specifies information necessary to assist the inspection team in choosing the focus areas (i.e., sample set) to be inspected by the cyber-security IP. This information should be made available via secure site (i.e., Sharepoint, Certrec) no later than June 10, 2019.
The inspection team will review this information and, by July 1, 2019, will request the specific items that should be provided for review.
The second group of additional requested documents will assist the inspection team in the evaluation of the critical systems and critical digital assets (CSs/CDAs), defensive architecture, and the areas of the licensees CSP selected for the cyber-security inspection. This information will be requested for review via secure site (i.e., Sharepoint, Certrec) before July 15, 2019.
The third group of requested documents consists of those items that the inspection team will review, or need access to, during the inspection. Please have this information available by the first day of the onsite inspection, August 12, 2019. The fourth group of information is necessary to aid the inspection team in tracking issues identified as a result of the inspection. It is requested that this information be provided to the lead inspector as the information is generated during the inspection. It is important that all of these documents are up to date and complete in order to minimize the number of additional documents requested during the preparation and/or the onsite portions of the inspection.
The lead inspector for this inspection is David Strickland. We understand that our regulatory contact for this inspection is Gene Surber of your organization. If there are any questions about the inspection or the material requested, please contact the lead inspector at 404-997-4440 or via e-mail at David.Strickland@nrc.gov.
This letter does not contain new or amended information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection requirements were approved by the Office of Management and Budget, control number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to a request for information or an information collection requirement unless the requesting document displays a currently valid Office of Management and Budget control number.
In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter and its enclosure will not be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Scott M. Shaeffer, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-348; 50-364 License Nos. NPF-2; NPF-8 Enclosure:
Security Inspection Document Request cc: See Page 3 cc:
Cyneetha Evans Site Security Manager Joseph M. Farley Nuclear Plant 7388 North State Highway 95 Columbia, AL 36319
_ML19100A007_ SUNSI REVIEW COMPLETE FORM 665 ATTACHED OFFICE RII/DRS/EB2 RII/DRS/EB2 SIGNATURE DWS5 SMS NAME D.STRICKLAND S.SHAEFFER DATE 4/ 9 /2019 4/ 10 / 2019 E-MAIL COPY? YES NO YES NO
Inspection Report: 05000348/2019013; 05000364/2019013 Inspection Dates: Weeks of August 12, 2019, and August 26, 2019 Inspection Procedure: IP 71130.10P, Cyber-Security, Revision 0 Reference: ML17156A215, Guidance Document for Development of the Request for Information (RFI) and Notification Letter for Full-Implementation of the Cyber-Security Inspection, Revision 0 NRC Inspectors: David Strickland, Lead Larry Jones 404-997-4440 404-997-4837 David.Strickland@nrc.gov Larry.Jones@nrc.gov NRC Contractors: Alan Konkal Alexander Prada Alan.Konkal@nrc.gov Alexander.Prada@nrc.gov I. Information Requested for In-Office Preparation The initial request for information (i.e., first RFI) concentrates on providing the inspection team with the general information necessary to select appropriate components and CSP elements to develop a site-specific inspection plan. The first RFI is used to identify the list of critical systems and critical digital assets (CSs/CDAs) plus operational and management (O&M) security control portions of the CSP to be chosen as the sample set required to be inspected by the cyber-security IP. The first RFIs requested information is specified below in Table RFI #1. The Table RFI #1 information is requested to be provided by, June 10, 2019 or sooner, to facilitate the selection of the specific items that will be reviewed during the onsite inspection weeks.
The inspection team will examine the returned documentation from the first RFI and identify/select specific systems and equipment (e.g., CSs/CDAs) to provide a more focused follow-up request to develop the second RFI. The inspection team will submit the specific systems and equipment list to your staff by July 1, 2019, which will identify the specific systems and equipment that will be utilized to evaluate the CSs/CDAs, defensive architecture, and the areas of the licensees CSP selected for the cyber-security inspection. We request that the additional information provided from the second RFI be made available by July 15, 2019. All requests for information shall follow the guidance document ML17156A215 referenced above.
Enclosure
The required Table RFI 1 information shall be provided via secure site (i.e., Sharepoint, Certrec) by June 10, 2019. The preferred file format for all lists is object character recognition (OCR) readable or a searchable Excel spreadsheet file. These files should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
Table RFI #1 Section 3, Paragraph Number/Title: Items 1 List All Identified Critical Systems and Critical Digital Assets All List CDA Facility and Site Ethernet - Transmission Control All 2 Protocol/Internet Protocol (TCP/IP) based Local Area Networks (LANs)
and identify those LANs that have non-CDAs on them List CDA facility and site non-ethernet TCP/IP based LANs including All 3 those industrial networks and identify LANs that have non-CDAs on them 4 Network Topology Diagrams (be sure to include all NIDS and SIEMs All for EP networks and Security level 3 and 4 networks)
8 List all network security boundary devices for EP networks and all All network security boundary devices for levels 3 and 4 9 List CDA wireless Industrial networks All 11 Network intrusion detection system documentation for Critical Systems (11.a.1)
that have CDAs associated with them (11.a.)
12 Security Information and Event Management (SIEM) documentation (12.a.1)
for Critical systems that have CDAs associated with them (12.a.2)
14 List EP and Security onsite and offsite digital communication systems All 25 Cyber-Security Assessment and Cyber-Security Incident Response All Teams 28 Copy of Current Cyber Security Plan and copy of any 50.54(p) All analysis to support changes to the plan In addition to the above information please provide the following:
(1) Electronic copy of the UFSAR and technical specifications.
(2) Name(s) and phone numbers for the regulatory and technical contacts.
Based on this information, the inspection team will identify and select specific systems and equipment (e.g., CSs/CDAs) from the information requested by Table RFI #1 and submit a list of specific systems and equipment to your staff by July 1, 2019 for the second RFI (i.e., RFI #2).
II. Additional Information Requested to be Available Prior to Inspection.
As stated in Section I above, the inspection team will examine the returned documentation requested from Table RFI #1 and submit the list of specific systems and equipment to your staff by July 1, 2019 for the second RFI (i.e., RFI #2). The second RFI will request additional information required to evaluate the CSs/CDAs, defensive architecture, and the areas of the licensees CSP selected for the cyber- security inspection. The additional information requested for the specific systems and equipment is identified in Table RFI #2. All requested information shall follow the guidance document ML17156A215 referenced above.
The Table RFI 2 information shall be provided on secure site (i.e., Sharepoint or Certrec)
by July 15, 2019. The preferred file format for all lists is object character recognition (OCR) readable or a searchable Excel spreadsheet file. These files should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
Table RFI #2 Section 3, Paragraph Number/Title: Items 5 Plant Computer System Block Diagram (if Plant Computer System is All selected for inspection)
6 Plant Security System Block Diagram (if Security Computer System is All selected for inspection)
7 Systems that are distributed Block Diagrams (for systems selected for All inspection)
10 Host-Based Intrusion Detection System Documentation (for CDAs for (10.a.1)
systems selected for inspection) (10.a.2)
13 List all Maintenance and Test Equipment (M&TE) used on CDAs for All systems selected for inspection 15 Configuration Management All 16 Supply Chain Management (16.a)
(16.b.1)
(16.b.6)
(16.b.5)
Table RFI #2 Section 3, Paragraph Number/Title: Items 17 Portable Media and Mobile Device Control All 18 Software Management All 20 Vendor Access and Monitoring All 21 Work Control All 22 Device Access and Key Control All 23 Password/Authenticator Policy All 24 User Account/Credential Policy All 26 Corrective Actions since last NRC inspection All 27 Cyber-Security Assessments for Selected Systems All III. Information Requested to be Available on First Day of Inspection For the specific systems and equipment identified in Section II above, provide the following RFI (i.e., Table 1ST Week Onsite) by August 12, 2019, the first day of the inspection. All requested information shall follow the guidance document ML17156A215 referenced above.
The preferred file format for all lists is object character recognition (OCR) readable or a searchable Excel spreadsheet file. These files should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
Table 1st Week Onsite Section 3, Paragraph Number/Title: Items 10 Host-Based Intrusion Detection System Documentation (for CDAs (10.a.3)
for systems selected for inspection) thru (10.a.12)
11 Network Intrusion Detection System Documentation for Critical (11.a.3)
Systems that have CDAs associated with them thru (11.a.15)
12 Security Information and Event Management (SIEM) Documentation (12.a.3)
for Critical Systems that have CDAs associated with them thru (12.a.14)
16 Supply Chain Management (16.b.2)
(6.b.3)
(16.b.4)
19 Cyber-Security Event Notifications All In addition to the above information please provide the following:
(1) Copies of the following documents do not need to be solely available to the inspection team as long as the inspectors have easy and unrestrained access to them.
a. Updated Final Safety Analysis Report, if not previously provided; b. Original FSAR Volumes; c. Original SER and Supplements; d. FSAR Question and Answers; e. Quality Assurance Plan; f. Technical Specifications, if not previously provided; g. Latest IPE/PRA Report; and h. Vendor Manuals, for applicable systems selected (2) Assessment and Corrective Actions:
a. The most recent Cyber-Security Quality Assurance (QA) audit and/or self-assessment; and b. The last 73.55(m) assessment performed; and c. Corrective action documents (e.g., condition reports, including status of corrective actions) generate as a result of the most recent Cyber-Security Quality Assurance (QA) audit and/or self-assessment.
IV. Information Requested To Be Provided Throughout the Inspection (1) Copies of any corrective action documents generated as a result of the inspection teams questions or queries during the inspection.
(2) Copies of the list of questions submitted by the inspection team members and the status/resolution of the information requested (provided daily during the inspection to each inspection team member).
If you have any questions regarding the information requested, please contact the inspection team.