ML12193A550

Draft SSES Cyber Security RAI v2

ML12193A550
Person / Time
Site:	Millstone, Susquehanna
Issue date:	07/11/2012
From:	Office of Nuclear Reactor Regulation
To:
Jeff Whited
Shared Package
ML12193A524	List: ML12193A550
References
Download: ML12193A550 (1)

Text

DRAFT OFFICE OF NUCLEAR SECURITY AND INCIDENT RESPONSE REQUEST FOR ADDITIONAL INFORMATION CHANGES TO CYBER SECURITY IMPLEMENTATION SCHEDULE MILESTONES 3 AND 6 PPL SUSQUEHANNA, LLC ALLEGHANY ELECTRIC COOPERATION, INC.

SUSQUEHANNA STEAM ELECTRIC STATION, UNITS 1 AND 2 DOCKET NUMBERS 50-387 AND 50-388 By letter dated April 30, 2012, 1 PPL Susquehanna, LLC (PPL) submitted a license amendment request for Susquehanna Steam Electric Station, Units 1 and 2 (SSES). The proposed amendment would make changes to the cyber security implementation schedule for Milestone 3 and 6. Specifically, for Milestone 3, PPL proposes to install a deterministic data diode appliance between Layers 3 and 2 instead of between Layers 3 and 4 with no change to the approved implementation date. For Milestone 6, PPL proposes to implement the technical controls for critical digital assets (CDAs) that could adversely impact the design function of physical security target set equipment by the approved implementation date, and to implement the operational and management controls for CDAs in conjunction with the full implementation of the Cyber Security Program.

The U.S. Nuclear Regulatory Commission (NRC) staff has reviewed the information provided by the licensee and has determined that the following additional information is needed in order to complete the review.

Milestone 3 of the Cyber Security Implementation Schedule implements installation of a deterministic one-way device between lower level devices and higher level devices as described in Section 4.3, Defense-in-Depth Protective Strategies of the Cyber Security Plan (CSP). In the April 30, 2012, request PPL states that (emphasis added) [f]or non-security critical digital assets (CDAs), the current implementation schedule and cyber security plan describe deterministic devices between Layers 3 and 4 with firewalls between Layers 1 and 2 and between Layers 2 and 3. PPL goes on to describe that the proposed change to the cyber defensive strategy would install a deterministic device between Layers 2 and 3 with firewalls between the other layers.

The NRC staff would like to clarify that this proposed change does not only impact Milestone 3, but also directly impacts the CSP, Section 4.3, Defense-in-Depth Protective Strategies. Will security CDAs and safety CDAs (both residing in Layer 4) continue to be isolated from each other as described in the existing CSP?

1 Agencywide Documents Access and Management System (ADAMS) Accession No. ML12122A011 DRAFT