ML102650608

Y020100184 - Response Letter - Oconee Digital Safety System Upgrade

ML102650608
Person / Time
Site:	Oconee
Issue date:	09/24/2010
From:	Hiland P Division of Engineering
To:	Weiss J - No Known Affiliation
Mossman, Tim 415-3647
Shared Package
ML102660078	List: ML102650608
References
TAC ME4630, Y020100184
Download: ML102650608 (2)

Text

September 24, 2010 Mr. Joseph Weiss 10029 Oakleaf Place Cupertino, CA 95014

SUBJECT:

OCONEE DIGITAL SAFETY SYSTEM UPGRADE

Dear Mr. Weiss:

I am responding to your August 13, 2010, e-mail to the U.S. Nuclear Regulatory Commission (NRC) staff that outlined your concerns regarding the installation of the digital Reactor Protective System / Engineered Safeguard Protective System (RPS/ESPS) at the Oconee Nuclear Station and the existence of the Stuxnet virus. The NRC values public interest in matters under its purview, and appreciates your willingness to raise these concerns.

The safety evaluation approving the Oconee license amendment for the RPS/ESPS was issued in January 2010. A copy of the safety evaluation (Agencywide Documents Access and Management System (ADAMS) Accession No. ML100220016) is available to the public at www.nrc.gov. The security section of the safety evaluation was based upon review of the license amendment against the criteria in Regulatory Guide 1.152, Revision 2; Criteria for Digital Computers in Safety Systems of Nuclear Power Plants. In addition, the NRCs Office of Nuclear Regulatory Research procured key portions of the system to be used at Oconee and funded research on their security capabilities and vulnerabilities. The details of this research and the majority of the details of the safety evaluation security section addressing the protection of the system from cyber threats were redacted in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390 to ensure information which may aid an adversary to plan and execute a cyber attack is not released.

The NRC staff has been aware of the Stuxnet virus that appears to target certain Siemens applications and has been in contact with the Department of Homeland Securitys United States Computer Emergency Readiness Team (US-CERT). The staff concluded that currently the Stuxnet virus does not pose a credible safety or security threat to the Oconee RPS/ESPS.

The NRC Cyber Assessment Team (CAT) actively coordinates with the US-CERT to assess and evaluate cyber security issues such as the Stuxnet malware and future variations, to ensure that information regarding emergent cyber issues is promptly communicated to the nuclear industry. Additionally, the NRC oversight and inspection process routinely monitors licensee performance and the actions that they take in response to issues like the Stuxnet virus. The NRC will continue to work with both public and private partners to identify and mitigate future variations of Stuxnet.

We want to assure you that we take your concerns very seriously. The NRC has taken measures to inform licensees about the potential threat posed by the Stuxnet virus. In addition, all U.S. nuclear power plants are in the process of implementing the requirements in 10 CFR 73.54, Protection of Digital Computer and Communication Systems and Networks, which requires licensees to provide high assurance that digital computer and communication systems

J. Weiss and networks are adequately protected against cyber threats, up to and including the design basis threat (DBT).

If you have any questions or require additional information regarding the Oconee RPS/ESPS review, please contact Mr. Tim Mossman, by phone at 301-415-3647, or by e-mail at Timothy.Mossman@nrc.gov. If you have any questions or require additional information regarding the NRCs cyber security regulations, guidance or on-going activities, please contact Mr. Craig Erlanger, by phone at 301-415-5374, or by e-mail at Craig.Erlanger@nrc.gov.

Sincerely,

/RA/

Patrick L. Hiland, Director Division of Engineering Office of Nuclear Reactor Regulation

ML102650608 *via e-mail OFFICE NRR/DE/EICB/BC NSIR/DSP/ISCPB/BC NSIR/DSO/DDSO/RSOB NAME WKemper CErlanger

• RCostello

• DATE 9/23/10 9/23/10 9/23/10 OFFICE NSIR/DSO/DDSO/DD NSIR/DSP/D NRR/DE/D NAME BWestreich

• RCorreia

• PHiland DATE 9/23/10 9/23/10 9/24/10