ML18239A388

NRC Approval of Centrus Energy Corp. Headquarters Classified Administrative Then Client System Security Control Security Plan

ML18239A388
Person / Time
Site:	07007004
Issue date:	09/04/2018
From:	Jacob Zimmerman NRC/NMSS/DFCSE/ECB
To:	Toelle S Centrus Energy Corp
Faraz Y
References
EPID C-2018-CYB-0000
Download: ML18239A388 (3)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 September 4, 2018 Mr. Steven A. Toelle, Director Regulatory Affairs Centrus Energy Corp.

6901 Rockledge Drive, Suite 800 Bethesda, MD 20817-1867

SUBJECT:

U.S. NUCLEAR REGULATORY COMMISSION APPROVAL OF CENTRUS ENERGY CORP. HEADQUARTERS CLASSIFIED ADMINISTRATIVE THIN CLIENT SYSTEM SECURITY CONTROL SECURITY PLAN (ENTERPRISE PROJECT IDENTIFIER C-2018-CYB-0000)

Dear Mr. Toelle:

By letter dated June 22, 2018 (AC 18-0004) (Agencywide Documents Access and Management System (ADAMS) Accession Number ML18184A066), Centrus Energy Corp. (Centrus) requested the U.S. Nuclear Regulatory Commission (NRC) approval of SP-HQ-0008, Centrus Energy Corp. Headquarters Classified Administrative Thin Client System Security Control Security Plan and supporting document SP-HQ-0007, Baseline Security Controls & Standards for Centrus Energy Classified Cyber Security Plans. Previously, by letter dated January 25, 2018 (AC 18-0002) (ADAMS Accession Number ML18031A956), Centrus had requested the NRC to review and approve a 180-day interim period for operating the Centrus Headquarters (HQ) classified network while committing to implement certain compensatory measures. On February 1, 2018, the NRC approved Centrus request contained in AC-18-0002, (ADAMS Accession Number ML18031B095). Before July 30, 2018, Centrus indicated to the NRC that it had terminated the classified network in accordance with NRCs February 1, 2018 approval of AC 18-0002.

On August 2, 2018, the NRC staff completed its acceptance review of AC 18-0004 and determined the need for supplemental information from Centrus as outlined in a Request for Supplemental Information (RSI) (ADAMS Accession Number ML17276B872). By letter dated August 6, 2014, (ADAMS Accession Number ML18235A275), Centrus responded to the RSI.

On August 8, 2018, NRC and Department of Energy Nuclear Energy Oak Ridge Site Office (DOE NE-ORSO) staff conducted an onsite inspection of the Centrus HQ classified network and determined that Centrus had appropriately (1) terminated the network, (2) addressed the RSI, and (3) put in place the controls needed to reestablish the network. During the inspection, Centrus was informed that it would need to conduct a security assessment of the HQ classified administrative thin client system and submit a Security Assessment Report (SAR). By letter dated August 10, 2018, (ADAMS Accession Number ML18234A145), Centrus submitted the SAR. By letter dated August 15, 2018 (ADAMS Accession Number ML18235A277) as the Authorizing Official for Centrus Classified Cyber Networks, DOE-NE-ORSO informed the NRC staff of its approval of Centrus request.

S. Toelle 2 The NRC staff has completed its review of AC 18-0004 and the supplemental information provided by Centrus, and has determined that SP-HQ-0008 is acceptable. Please reference Docket Number 07007004 and Enterprise Project Identification Number C-2018-CYB-0000 in future correspondence related to this action.

In accordance with Title 10 of the Code of Federal Regulations, Part 2.390 of the NRCs Agency Rules of Practice and Procedure, a copy of this letter will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRCs ADAMS. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

If you have any questions regarding this action, please contact Mr. Faraz by telephone at (301) 415-7220, or via e-mail at Yawar.Faraz@nrc.gov.

Sincerely,

/RA/

Jacob I. Zimmerman, Chief Enrichment and Conversion Branch Division of Fuel Cycle Safety, Safeguards, and Environmental Review Office of Nuclear Material Safety and Safeguards Docket No. 07007004 License No. SNM-2011 cc: Mr. R. DeVault, DOE Mr. J. Hutson, DOE Mr. L. Cutlip, Centrus

S. Toelle 3

SUBJECT:

U.S. NUCLEAR REGULATORY COMMISSION APPROVAL OF CENTRUS ENERGY CORP. HEADQUARTERS CLASSIFIED ADMINISTRATIVE THIN CLIENT SYSTEM SECURITY CONTROL SECURITY PLAN (ENTERPRISE PROJECT IDENTIFIER C-2018-CYB-0000)

DATED: September 4, 2018 DISTRIBUTION:

FCSE, r/f OSiurano, NMSS JSmith, NMSS GHenderson, OGC MSykes, RII MLearn, RIII MKunowski, RIII LPitts, RII BSmith, NMSS JKEverly, NSIR LClark, OGC NStAmour, OGC ADAMS Accession Number: ML18239A388 (*via e-mail)

OFC FCSE/ECB FCSE/ERB NSIR FCSE/ECB NAME YFaraz AWalker-Smith *DParsons JZimmerman DATE 08/27/2018 08/28/2018 08/30/2018 09/04/2018 OFFICIAL RECORD COPY