ML21119A269

Letter - Notice of Change in the Authorizing Official and Extension of the Interim Authorization to Operate for Centrus Tmc

ML21119A269
Person / Time
Site:	07007003, 07007004
Issue date:	05/13/2021
From:	Jacob Zimmerman NRC/NMSS/DFM/FFLB
To:	Wiehle K American Centrifuge Operating
MABartlett NMSS/DFM/FFL 301.415.7154
Shared Package
ML21119A268	List: ML21119A269 ML21119A270
References
Download: ML21119A269 (3)

Text

OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 13, 2021 Ms. Kelly L. Wiehle, Regulatory Manager American Centrifuge Operating, LLC P.O. Box 628 Mail Stop 7560 3930 U.S. 23 South Piketon, Ohio 45661

SUBJECT:

NOTICE OF CHANGE IN AUTHORIZING OFFICIAL AND EXTENSION OF THE INTERIM AUTHORIZATION TO OPERATE FOR CENTRUS ENERGY CORPORATION AMERICAN CENTRIFUGE OPERATIONS FOR THE CLASSIFIED CYBER SYSTEM LOCATED IN OAK RIDGE, TENNESSEE (EPID: L-2019-PMP-0196)

Dear Ms. Wiehle:

As you are aware, the U.S. Department of Energys Office of Nuclear Energy is no longer serving as the authorizing official (AO) for classified information systems and networks that are under U.S. Nuclear Regulatory Commission (NRC) regulatory oversight at the Centrus Energy Corporation American Centrifuge Operations Technology and Manufacturing Center (TMC) in Oak Ridge, Tennessee. On January 15, 2021, the Executive Director for Operations of the NRC designated the Chief Information Officer at the NRC, as the new AO for Centrus Energy Corporations classified information systems and networks. This designation is made consistent with the Federal Information Security Modernization Act of 2014, Public Law 113-283, and with the Department of Defense 5220.22-M, National Industry Security Program Operating Manual, Chapter 8 IS Security, Section 2 Assessment and Authorization.

The Chief Information Security Officer (CISO), with assistance from other NRC staff, have performed an assessment of the existing security controls, security plans, authorizations, inspection reports, and other relevant supporting documentation for the classified information systems and networks. Based on this assessment, the NRC AO has approved an Interim Authority to Operate (IATO) for the TMC until November 1, 2021, based on the conditions provided below:

• The stand-alone systems remain in a ready state and are to be used only for limited manufacturing runs and one-offs, for maintenance and training purposes; Enclosure 2 transmitted by this letter contains Security-Related Information. When separated from Enclosure 2, this letter and Enclosure 1 are decontrolled.

OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION

OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION K. Wiehle 2

• In the event production is resumed, a reassessment and reaccreditation efforts are to be performed to address access control, account management, supply chain, disaster recovery, modernization among other controls;

• All documentation and artifacts are updated and reviewed on a regular basis or as conditions warrant;

• All inspection reports, continuous monitoring reports, or other pertinent and related documentation is provided to the AO and CISO as they are produced or updated;

• Targeted checks of controls are to occur periodically or as otherwise required, and results communicated back to the AO and CISO;

• The AO and CISO are provided with quarterly system updates;

• All system changes must be reported to the AO and CISO prior to implementation for assessment and approval; and

• All security-related events relative to the systems are to be reported to the AO and CISO within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery.

The approval is documented in Enclosure 1, NRC Approval to Extend the Interim Authorization to Operate for the Centrus TMC, and the basis for the NRC decision is provided in Enclosure 2, Basis for Approval to Extend the Interim Authorization to Operate for the Centrus TMC.

Please note that the AO has stipulated that a reaccreditation effort shall take place prior to the expiration of the IATO, or in the event of identified major system changes.

In accordance with Title 10 of the Code of Federal Regulations, Part 2.390 of the NRCs Agency Rules of Practice and Procedure, a copy of this letter will be available electronically for public inspection in the NRC Public Document Room and the Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

If you have any questions regarding this matter, please contact me or Mr. Yawar Faraz by telephone at: 301-415-7220, or via email to: Yawar.Faraz@NRC.gov.

Sincerely,

, acting for Jacob I. Zimmerman, Branch Chief Fuel Facility Licensing Branch Division of Fuel Management Office of Nuclear Material Safety and Safeguards Docket Nos. 07007003, 07007004 License Nos. SNM-7003, SNM-2011

Enclosures:

1. NRC Approval of IATO Extension

2. Basis for IATO Extension (non-public) cc: centrus_acp@listmgr.nrc.gov OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION

ML21119A268 (Pkg) ML21119A269 (Ltr)

ML21119A270 (Encl 1) ML21119A271 (Encl 2) *via email OFFICE NMSS/DFM/ NMSS/DFM/ NMSS/DFM/ NSIR/DSO/ NMSS/DFM/

FFLB/PM* FFLB/PM* FFLB/LA* ISB/BC* FFLB/BC*

NAME MBartlett YFaraz ELee DParsons MBartlett acting for JZimmerman DATE 4/29/2021 05/04/2021 05/04/2021 05/12/2021 5/12/2021