ML21119A270

Enclosure 1 - NRC Approval to Extend the Interim Authorization to Operate for the Centrus Tmc

ML21119A270
Person / Time
Site:	07007003, 07007004
Issue date:	04/28/2021
From:	Matt Bartlett NRC/NMSS/DFM/FFLB
To:	Matt Bartlett American Centrifuge Operating
MABartlett NMSS/DFM/FFL 301.415.7154
Shared Package
ML21119A268	List: ML21119A269 ML21119A270
References
Download: ML21119A270 (2)

Text

Bartlett, Matt From: Bartlett, Matt Sent: Wednesday, April 28, 2021 1:42 PM To: Matt Bartlett

Subject:

FW: UPDATED: IATO Request for Centrus ACO Oak Ridge Classified Cyber System As stated below, the IATO for the Centrus Energy Corporation American Centrifuge Operations Technology and Manufacturing Center (TMC) in Oak Ridge, Tennessee is extended to November 01, 2021 From: Nelson, David <David.Nelson@nrc.gov>

Sent: Tuesday, April 27, 2021 9:19 AM To: Nalabandian, Garo <Garo.Nalabandian@nrc.gov>; Flanders, Scott <Scott.Flanders@nrc.gov>

Cc: et. al.

Subject:

RE: UPDATED: IATO Request for Centrus ACO Oak Ridge Classified Cyber System Based on this assessment and recommendation from the NRC acting CISO, the Interim Authorization to Operate (IATO) for the NRC licensee Centrus Energy Corporation American Centrifuge Operations (ACO)

Classified Cyber System located in Oak Ridge, Tennessee is extended until November 01, 2021 with the revised conditions described below in the CISO recommendation.

Dave David Nelson Director, Office of the Chief Information Officer - CIO United States Nuclear Regulatory Commission Phone: 3014158700 From: Nalabandian, Garo <Garo.Nalabandian@nrc.gov>

Sent: Tuesday, April 27, 2021 9:00 AM To: Nelson, David <David.Nelson@nrc.gov>;

Subject:

FW: UPDATED: IATO Request for Centrus ACO Oak Ridge Classified Cyber System Importance: High

Dave, In my role as the NRC acting Chief Information Security Officer (CISO) and with input from the Cybersecurity Branch, I recommend approval for an Interim Authority to Operate (IATO) for the NRC licensee Centrus Energy Corporation American Centrifuge Operations (ACO) Classified Cyber System located in Oak Ridge, Tennessee with the revised conditions described below. This IATO shall be in place until November 01, 2021 with the condition that the stand alone systems remain in a ready state and used only for limited manufacturing runs, one-offs, and maintenance and training purposes. The limited manufacturing runs consist of less than a dozen pieces and one-offs and are performed by a small number of staff, six engineers, using no more than six of the stand-alone machines. The licensee will notify the NRC if production runs increase in any capacity and allow us access to the systems used for further review.

In the event production is resumed in full before this IATO expires, a new assessment must be performed on these systems that addresses reviewing specific controls listed below under the conditions. This recommendation is based on the assessment provided below by the NRC Cybersecurity Oversight Team, Cybersecurity Branch, Office of the Chief Information Officer.

Please note the conditions are as follows with the updated conditions highlighted.

1

The stand-alone systems remain in a ready state and are to be used only for limited manufacturing runs and one-offs, for maintenance and training purposes; In the event production is resumed, a reassessment and reaccreditation efforts are to be performed to address access control, account management, supply chain, disaster recovery, modernization among other controls; All documentation and artifacts are updated and reviewed on a regular basis or as conditions warrant; All inspection reports, continuous monitoring reports, or other pertinent and related documentation is provided to the AO and Chief Information Security Officer (CISO) as they are produced or updated; Targeted checks of controls are to occur periodically or as otherwise required and results communicated back to the AO and CISO; The AO and CISO are provided with quarterly system updates; All system changes must be reported to the AO and CISO prior to implementation for assessment and approval; All security related events relative to the systems are to be reported to the AO and CISO within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery.

If you decide to issue an IATO based on this recommendation, please digitally sign and reply to all on this original email. The email will then be entered into the Agencywide Documents Access and Management System and serve to document the issuance of this IATO.

If you or any other stakeholder would like further information regarding the authorization recommendation, we are happy to discuss further and provide any additional clarification.

Thank you, Garo Garo Nalabandian Chief Information Security Officer (acting)

U.S. Nuclear Regulatory Commission Office of the Chief Information Officer 11545 Rockville Pike, Rockville, MD 20850 2