ML12193A545

Draft SSES Cyber Security RAI

ML12193A545
Person / Time
Site:	Millstone, Susquehanna
Issue date:	07/11/2012
From:	Office of Nuclear Reactor Regulation
To:
Jeff Whited
Shared Package
ml12193A524	List: ML12193A545
References
Download: ML12193A545 (1)

Text

DRAFT OFFICE OF NUCLEAR SECURITY AND INCIDENT RESPONSE REQUEST FOR ADDITIONAL INFORMATION CHANGES TO CYBER SECUIRTY IMPLEMENTATION SCHEDULE MILESTONES 3 AND 6 PPL SUSQUEHANNA, LLC ALLEGHANY ELECTRIC COOPERATION, INC.

SUSQUEHANNA STEAM ELECTRIC STATION, UNITS 1 AND 2 DOCKET NUMBERS 50-387 AND 50-388 By letter dated April 30, 2012, 1 PPL Susquehanna, LLC (PPL) submitted a license amendment request for Susquehanna Steam Electric Station, Units 1 and 2 (SSES). The proposed amendment would make changes to the cyber security implementation schedule for milestone 3 and 6. Specifically, for milestone 3 PPL proposes to install a deterministic data diode appliance between Layers 3 and 2 instead of between Layers 3 and 4 with no change to the approved implementation date. For milestone 6, PPL proposes to implement the technical controls for critical digital assets (CDAs) by the approved implementation date, and to implement the operational and management controls for CDAs in conjunction with the full implementation of the Cyber Security Program.

The U.S. Nuclear Regulatory Commission (NRC) staff has reviewed the information provided by the licensee and has determined that the following additional information is needed in order to complete the review.

Milestone 3 of the Cyber Security Implementation Schedule implements installation of a deterministic one-way device between lower level devices and higher level devices as described in Section 4.3, Defense-in-Depth Protective Strategies of the Cyber Security Plan (CSP). In the April 30, 2012, request PPL states that (emphasis added) [f]or non-security critical digital assets (CDAs), the current implementation schedule and cyber security plan describe deterministic devices between Layers 3 and 4 with firewalls between Layers 1 and 2 and between Layers 2 and 3. PPL goes on to describe that the proposed change to the cyber defensive strategy would install a deterministic data diode appliance between Layers 2 and 3 with firewalls between the other layers.

Please explain how CDAs associated with safety, important to safety and security functions, as well as support systems and equipment which, if compromised, would adversely impact safety, important to safety and security functions will be affected by this change.

1 Agencywide Documents Access and Management System (ADAMS) Accession No. ML12122A011 DRAFT