ML041540347

From kanterella
Jump to navigation Jump to search
Use of Encryption Software for Electronic Transmission of Safeguards Information
ML041540347
Person / Time
Site: Davis Besse Cleveland Electric icon.png
Issue date: 05/28/2004
From: Bezilla M
FirstEnergy Nuclear Operating Co
To:
Document Control Desk, Office of Nuclear Reactor Regulation
References
305800
Download: ML041540347 (3)


Text

.- t FENOC FENO 5501 North State Route 2 FirstEnergy Nuclear Operating Company Oak Harbor, Ohio 43449 Mark B. Belal 419-321-7676 Vice President - Nuclear Fax: 419-321-7582 Docket Number 50-346 License Number NPF-3 Serial Number 3058 May 28, 2004 United States Nuclear Regulatory Commission Document Control Desk Washington, D.C. 20555-0001

References:

1. 10 CFR 73.21
2. NRC Regulatory Issue Summary 2002-15

Subject:

Use of Encryption Software for Electronic Transmission of Safeguards Information Ladies and Gentlemen:

Pursuant to the requirements of 10 CFR 73.21(g)(3), the FirstEnergy Nuclear Operating Company (FENOC) requests approval to process and transmit Safeguards Information (SGI) at the Davis-Besse Nuclear Power Station (DBNPS) using PGP Software (Enterprise, Corporate, or Personal) Desktop Version 8.0 or the latest validated version, developed with PGP SDK 3.0.3.

National Institute of Standards and Technology Certificate 394 validates compliance of this SDK with Federal Information Processing Standard (FIPS) 140-2 requirements.

An information protection system for SGI that meets the requirements of 10 CFR 73.21 (b) through (i) has been established and is being maintained. Prior to the first use of encryption software for SGI material, written procedures shall be in place to describe, as a minimum: access controls; where and when encrypted communications can be made; how encryption keys, codes and passwords will be protected from compromise; actions to be taken if the encryption keys, codes or passwords are, or are suspected to have been, compromised (for example, notification of all authorized users); and how the identity and access authorization of the recipient will be verified.

FENOC intends to exchange SGI with the NRC, Nuclear Energy Institute (NEI), and other SGI holders who have received NRC approval to use PGP software. Mr. Alan R. Schumaker, Nuclear Security Support Supervisor, is responsible for the overall implementation of the SGI encryption program at the DBNPS. Mr. Gary L. Garrett, FENOC Information Technology Business Systems Manager, is responsible for collecting, safeguarding, and disseminating the software tools needed for encryption and decryption of SGI for FENOC.

Pursuant to 10 CFR 73.21 (g)(3), the transmission of encrypted material to other authorized SGI holders, who have received NRC approval to use PGP software, would be considered a protected telecommunications system. The transmission and dissemination of unencrypted SGI is subject to the provisions of 10 CFR 73.21(g)(1) and (2).

50OD

I - - .I Docket Number 50-346 License Number NPF-3 Serial Number 3058 Page 2 of 2 Should you have any questions or require additional information, please contact Mr. Schumaker at 419-249-2348.

Sincerely, Mark B. Bezilla Vice President, Nuclear GMW/s Attachment 1: Commitment List cc: James L. Caldwell, Regional Administrator, NRC Region III Jon B. Hopkins, DB-1 Senior NRC/NRR Project Manager C. Scott Thomas, DB-1 Senior NRC Resident Inspector Scott Morris, NRC/NISR Lynn Silvious, NRC/NSIR Louis Grosman, NRC/OCIO James Davis, NEI Utility Radiological Safety Board

Docket Number 50-346 License Number NPF-3 Serial Number 3058 , Page 1 of 1 COMMITMENT LIST The following list identifies those actions committed to by the Davis-Besse Nuclear Power Station in this document. Any other actions discussed in the submittal represent intended or planned actions by Davis-Besse. They are described only as information and are not regulatory commitments. Please notify the Manager - Regulatory Affairs (419-321-8450) at Davis-Besse of any questions regarding this document or associated regulatory commitments.

COMMITMENTS DUE DATE Implement written procedures to describe, as a minimum: Prior to the first use of access controls; where and wvhen encrypted communications encryption software can be made; how encryption keys, codes and passwords for SGI material will be protected from compromise; actions to be taken if the encryption keys, codes or passwords are, or are suspected to have been, compromised (for example, notification of all authorized users); and how the identity and access authorization of the recipient will be verified.