ML17132A071

Information Request the Cyber Security Baseline Inspection, Notification to Perform Inspection 05000498/2017407; 05000499/2017407

ML17132A071
Person / Time
Site:	South Texas
Issue date:	05/15/2017
From:	Greg Werner Operations Branch IV
To:	Gerry Powell South Texas
Werner G
References
IR 2017407
Download: ML17132A071 (8)

See also: IR 05000498/2017407

Text

May 15, 2017

Mr. G. T. Powell

Executive Vice President and CNO

STP Nuclear Operating Company

P.O. Box 289

Wadsworth, TX 77483

SUBJECT: SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION,

UNITS 1 AND 2 - INFORMATION REQUEST THE CYBER SECURITY BASELINE INSPECTION,

NOTIFICATION TO PERFORM INSPECTION

05000498/2017407; 05000499/2017407

Dear Mr. Powell:

On July 24, 2017, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline inspection at the

South Texas Project Electric Generating Station. This inspection evaluates and verifies your ability to

meet the full implementation requirements of the NRCs Cyber Security Rule, Title 10, Code of Federal

Regulations (CFR), Part 73, Section 54, Protection of Digital Computer and Communication Systems and

Networks. The onsite portion of the inspection will take place during the weeks of July 24, 2017, and

August 7, 2017.

Experience has shown that baseline inspections are extremely resource intensive, both for the NRC

inspectors and the licensee staff. In order to minimize the inspection impact on the site and to ensure a

productive inspection for both parties, we have enclosed a request for documents needed for the

inspection. These documents have been divided into four groups.

The first group specifies information necessary to assist the team in choosing the focus areas

(i.e., sample set) to be inspected in accordance with the cyber security inspection procedure. This

information should be made available using a compact disc and delivered to the regional office no later

than June 5, 2017. The inspection team will review this information and by the end of the planned

information gathering visit on June 22, 2017, will request the specific items that should be provided for

review.

The second group of requested documents will assist the team in their evaluation of the critical systems

and critical digital assets, defensive architecture, and the areas of the cyber security program selected

for inspection. This information will be requested for review in the regional office prior to the

inspection by July 7, 2017, as identified above.

G. Powell 2

The third group of requested documents consists of those items that the team will review or need

access to during the inspection. Please have this information available by the first day of the onsite

inspection July 24, 2017.

The fourth group of information is necessary to aid the team in tracking issues identified as a result of

the inspection. It is requested that this information be provided to the lead inspector as the information

is generated during the inspection. It is important that all of these documents are up to date and

complete in order to minimize the number of additional documents requested during the preparation

and/or the onsite portions of the inspection.

The lead inspector for this inspection is Greg Pick. We understand that our regulatory contact for this

inspection is Marilyn Kistler of your organization. If there are any questions about the inspection or the

material requested, please contact Greg at 817 200-1270 or by e-mail at greg.pick@nrc.gov.

This letter does not contain new or amended information collection requirements subject to the

Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection requirements

were approved by the Office of Management and Budget, control number 3150-0011. The NRC may not

conduct or sponsor, and a person is not required to respond to, a request for information or an

information collection requirement unless the requesting document displays a currently valid Office of

Management and Budget control number.

In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the

NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public

inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS)

component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is

accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic

Reading Room).

Sincerely,

/RA John Mateychick Acting for/

Gregory E. Werner, Chief

Engineering Branch 2

Division of Reactor Safety

Docket Nos. 50-498 and 50-499

License Nos. NPF-76 and NPF-80

Enclosure:

South Texas Project Electric Generating Station -

Cyber Security Inspection Document Request

cc w/ encl: Electronic Distribution

South Texas Project Electric Generating Station -

Cyber Security Inspection Document Request

Inspection Report: 05000498/2017407; 05000499/2017407

Inspection Dates: Weeks of July 24, 2017, and August 7, 2017

Inspection Procedure: IP 71130.10, Cyber Security, (In review process at time of request)

Reference 1: Guidance Document for Development of the Request for Information

(RFI) and Notification Letter for Full-Implementation of the Cyber

Security Inspection (draft) dated February 2017

NRC Inspectors: Greg Pick, Lead Samuel Graves

817-200-1270 817-200-1102

greg.pick@nrc.gov samuel.graves@nrc.gov

Shiattin Makor

817-200-1507

shiattin.makor@nrc.gov

NRC Contractors: Alan Konkal Casey Priester

561-989-0210 301-230-4590

alan.konkal@nrc.gov frederick.priester@nrc.gov

I. Information Requested for In-Office Preparation

The initial request for information (i.e., first request for information) provides the team with the

general information necessary to select appropriate components and cyber security program

elements to develop a site-specific inspection plan. The team will use the first set of

information requested to identify the list of critical systems and critical digital assets plus

operational and management security control portions of the Cyber Security Plan to be chosen

as the sample set required to be inspected during this inspection. The first information

request is specified in Table RFI #1. Provide the first set of information to the team leader in the

regional office by June 5, 2017, or sooner, to facilitate the selection of the specific items that will

be reviewed during the onsite inspection weeks.

The team will examine the returned documentation from the first information request and

select specific systems and equipment to provide a more focused second request for

information. The team will submit the second information request to your staff by the end of

the information gathering visit on June 22, 2017, which will identify the specific systems and

equipment that will be utilized to evaluate the critical systems and critical digital assets,

defensive architecture, and the areas of the cyber security program selected for the cyber

security inspection. All requests for information shall follow the guidance in Reference 1.

The required Table RFI #1 information shall be provided on compact disc (CD) to the lead

inspector by June 5, 2017. Please provide four copies of each CD submitted (i.e., one for each

Enclosure

inspector/contractor). The preferred file format for all lists is a searchable Excel spreadsheet file

on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any

questions regarding this information, please call the inspection team leader as soon as possible.

Table RFI #1

Section 3,

Paragraph Number/Title: Items

1 List All Identified Critical Systems and Critical Digital Assets All

List All Facility and Site Ethernet - Transmission Control Protocol/Internet All

2

Protocol (TCP/IP)-Based Local Area Networks (LANs)

3 List All Facility and Site Non-Ethernet-TCP/IP-Based LANs All

4 Network Topology Diagrams All

8 List All Network Security Boundary Devices All

9 List All Plant Wired and Wireless Industrial Networks All

11.a.1)

11 Network Intrusion Detection System Documentation

11.a.2)

12.a.1)

12 Security Information and Event Management Documentation

12.a.2)

14 List Onsite and External/Offsite Digital Communications Systems and Devices All

17.a

17 Mobile Device Control

17.b

18 Portable Media Control All

19.a

19 Software Management

19.b.1)

24 Device Access and Key Control 24.a

27 Cyber Security Assessment and Cyber Security Incident Response Teams All

In addition to the above information please provide the following:

(1) Electronic copy of the UFSAR and technical specifications

(2) Name(s) and phone numbers for the regulatory and technical contacts

(3) Current management and engineering organizational charts

Based on this information, the team will identify and select specific systems and equipment

(e.g., critical systems and critical digital assets) from the information requested by Table RFI #1

and submit a list of specific systems and equipment to your staff by the end of the information

gathering visit on June 22, 2017, for the second information request (i.e., Table RFI #2).

2

II. Additional Information Requested to be Available Prior to Inspection

As stated in Section I above, the team will examine the returned documentation requested from

the initial information request and submit the list of specific systems and equipment to your

staff by the end of the information gathering visit on June 22, 2017, for the second request for

information (i.e., Table RFI #2). This second information request obtains additional documents

required to evaluate the critical systems and critical digital assets, defensive architecture, and

the areas of the cyber security program selected for the cyber security inspection. All requested

information shall follow Reference 1.

The Table RFI 2 information shall be provided on CD to the lead inspector by July 7, 2017. Please

provide four copies of each CD submitted (i.e., one for each inspector/contractor). The

preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should

be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this

information, please call the inspection team leader as soon as possible.

Table RFI #2

Section 3,

Paragraph Number/Title: Items

5 Plant Computer System Block Diagram All

6 Plant Security System Block Diagram All

7 Systems that are distributed Block Diagrams All

10.a.1)

10 Host-Based Intrusion Detection System Documentation

10.a.2)

List All Maintenance and Test Equipment Used To Administer CDA All

13

Operation, Support, Maintenance, and Service

15 Configuration Management All

16.a.

16.b.1)

16 Supply Chain Management

16.b.5)

16.b.6)

17.c

17 Mobile Device Control

17.d

19.b.2)

19 Software Management

19.b.3)

23 Work Control All

24.b

24 Device Access and Key Control

24.c

3

Table RFI #2

Section 3,

Paragraph Number/Title: Items

25 Password/Authenticator Policy All

26 User Account/Credential Policy All

III. Information Requested to be Available on First Day of Inspection

For the specific systems and equipment identified in Section II above, provide the following

request for information (i.e., Table 1ST Week Onsite) on CD by July 24, 2017, the first day of the

inspection. All requested information shall follow the guidance in Reference 1.

Please provide four copies of each CD submitted (i.e., one for each inspector/contactor). The

preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should

be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this

information, please call the inspection team leader as soon as possible.

Table 1ST Week Onsite

Section 3,

Paragraph Number/Title: Items

10.a.3)

10 Host-Based Intrusion Detection System Documentation thru

10.a.12)

11.a.3)

11 Network Intrusion Detection System Documentation thru

11.a.15)

12.a.3)

12 Security Information and Event Management Documentation thru

12.a.14)

16.b.2)

16 Supply Chain Management 16.b.3)

16.b.4)

20 Cyber Security Event Notifications All

21 Inventory Management and Control All

22 Vendor Access and Monitoring All

4

In addition to the above information please provide the following:

(1) Copies of the following documents do not need to be solely available to the inspection

team as long as the inspectors have easy and unrestrained access to them.

a. Updated Final Safety Analysis Report, if not previously provided;

b. Original FSAR Volumes;

c. Original SER and Supplements;

d. FSAR Question and Answers;

e. Quality Assurance Plan;

f. Technical Specifications, if not previously provided;

g. Latest IPE/PRA Report; and

(2) Vendor Manuals, Assessments, and Corrective Actions:

a. The most recent cyber security quality assurance audit and/or

self-assessment; and

b. Corrective action documents (e.g., condition reports, including status of

corrective actions) generate as a result of the most recent cyber security

quality assurance audit and/or self-assessment.

IV. Information Requested To Be Provided Throughout the Inspection

(1) Copies of any corrective action documents generated as a result of the inspection

teams questions or queries during the inspection.

(2) Copies of the list of questions submitted by the inspection team members and the

status/resolution of the information requested (provided daily during the inspection to

each inspection team member).

If you have any questions regarding the information requested, please contact the team leader.

5

ML17132A071

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword: NRC-002

By: GAP Yes No Publicly Available Sensitive

OFFICE SRI:EB2 BC:EB2

NAME G. Pick G. Werner

SIGNATURE /RA/ /RA/J.

Mateychick for

DATE 05/08/2017 05/15/2017