ML17046A650

Endorsement of NEI 13-10, Cyber Security Control Assessments, Revision 5, Dated February 2017

ML17046A650
Person / Time
Site:	Nuclear Energy Institute
Issue date:	02/10/2017
From:	Perkins-Grew S Nuclear Energy Institute
To:	Andersen J Division of Security Policy
Pantalo, Charity
References
Download: ML17046A650 (2)

Text

SUE PERKINS-GREW Sr. Director, Nuclear Security & Incident Preparedness 1201 F Street, NW, Suite 1100 Washington, DC 20004 P: 202.739.8016 spg@nei.org nei.org February 10, 2017 Mr. James W. Andersen Director, Division of Security Policy Nuclear Security and Incident Response U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Endorsement of NEI 13-10, Cyber Security Control Assessments, Revision 5, Dated February 2017 Project Number: 689

Dear Mr. Andersen:

By letter dated November 30, 2015, the Nuclear Energy Institute (NEI)1 submitted, on behalf of the nuclear energy industry, NEI 13-10, Cyber Security Control Assessments, Revision 4, dated November 2015, for U.S.

Nuclear Regulatory Commission (NRC) review and endorsement (NRC Agencywide Documents Access and Management System (ADAMS) Accession No. ML15338A276). Subsequently, by letter dated December 21, 2015, the NRC informed NEI that NEI 13-10, Revision 4, is acceptable for use by licensees (ADAMS Accession No. ML15351A065).

The attached NEI 13-10, Revision 5, addresses lessons learned from a workshop conducted in 2016 that included industry and NRC observers. Revision 5 modifies Section 3, Consequence Assessment of CDAs, to enhance clarity for assigning CDAs to categories. Other clarifications were made that are intended to enhance both industry implementation and NRC oversight activities. For example, Tables 1 and 2 from Revision 4 were removed and the guidance contained in those tables was moved to body of the text.

Additionally, several enhancements were made to fully integrate the Balance-of-Plant category that was introduced in Revision 3. Changes to reflect the enhancements to Revision 5 were incorporated into the examples in Appendix C, and two additional appendices were added: Appendix E contains questions and 1

The Nuclear Energy Institute (NEI) is the organization responsible for establishing unified industry policy on matters affecting the nuclear energy industry, including the regulatory aspects of generic operational and technical issues. NEI's members include all entities licensed to operate commercial nuclear power plants in the United States, nuclear plant designers, major architect/engineering firms, fuel cycle facilities, nuclear materials licensees, and other organizations and entities involved in the nuclear energy industry.

Mr. James W. Andersen February 10, 2017 Page 2 answers based on lessons learned; and, Appendix F addresses NEI 08-09, Revision 6 programmatic controls for non-Direct CDAs.

NEI requests that the NRC review and endorse NEI 13-10, Revision 5, dated February 2017, by March 15, 2017. If any revisions to this document are desired, please include suggested wording and the technical data to support the proposed change(s).

If you have questions or require additional information, please contact William Gross (202-739-8123; wrg@nei.org).

Sincerely, Susan H. Perkins-Grew Attachment c: Mr. James D. Beardsley, NSIR/CSD, NRC NRC Document Control Desk