ML22322A212

Shine Medical Technologies - Cybersecurity Audit Summary Report

ML22322A212
Person / Time
Site:	SHINE Medical Technologies
Issue date:	12/02/2022
From:	Michael Balazik NRC/NRR/DANU/UNPL
To:	Piefer G SHINE Technologies
Balazik M
References
EPID L-2019-NEW-0004
Download: ML22322A212 (1)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 December 2, 2022 Dr. Gregory Piefer, Chief Executive Officer SHINE Medical Technologies, LLC 101 East Milwaukee Street, Suite 600 Janesville, WI 53545

SUBJECT:

SHINE MEDICAL TECHNOLOGIES, LLC -

SUMMARY

OF REGULATORY AUDIT OF CYBERSECURITY TOPICS RELATED TO SHINE OPERATING LICENSE APPLICATION (EPID NO. L-2019-NEW-0004)

Dear Dr. Piefer:

By letter dated July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ML19337A275), March 27, 2020 (ML20105A295), August 28, 2020 (ML20255A027),

November 13, 2020 (ML20325A026), December 10, 2020 (ML20357A084), and December 15, 2020 (ML21011A264), SHINE Medical Technologies, LLC (SHINE) submitted to the U.S. Nuclear Regulatory Commission (NRC) an operating license application for its proposed SHINE Medical Isotope Production Facility in accordance with the requirements contained in Title 10 of the Code of Federal Regulations Part 50, Domestic Licensing of Production and Utilization Facilities.

To enhance its review of cybersecurity topics described in SHINEs operating license application, the NRC staff conducted a virtual regulatory audit on June 15, 2021. The NRC staff performed its audit in accordance with the regulatory audit plan provided to the licensee by letter dated June 10, 2021 (ML21161A116). A summary of the regulatory audit is enclosed.

The audit report does not make any licensing conclusions or findings, but it is part of the administrative record of the NRC staffs review of the application and may provide information supporting the NRC staffs safety evaluation.

G. Piefer If SHINE has any questions, please contact me at (301) 415-2856, or by electronic mail at Michael.Balazik@nrc.gov.

Sincerely, Hardesty, Duane signing on behalf of Balazik, Michael on 12/02/22 Michael F. Balazik, Project Manager Non-Power Production and Utilization Facility Licensing Branch Division of Advanced Reactors and Non-Power Production and Utilization Facilities Office of Nuclear Reactor Regulation Docket No. 50-608 Construction Permit No. CPMIF-001

Enclosure:

Regulatory Audit Summary cc: See next page

SHINE Medical Technologies, LLC Docket No. 50-608 cc:

Jeff Bartelme Licensing Manager SHINE Technologies, LLC 3400 Innovation Court Janesville, WI 53546 Nathan Schleifer General Counsel SHINE Technologies, LLC 3400 Innovation Court Janesville, WI 53546 Christopher Landers Director, Office of Conversion National Nuclear Security Administration, NA 23 U.S. Department of Energy 1000 Independence Ave SW Washington, DC 20585 Mark Paulson, Supervisor Radiation Protection Section Wisconsin Department of Health Services P.O. Box 2659 Madison, WI 53701-2659 Test, Research and Training Reactor Newsletter Attention: Amber Johnson Dept of Materials Science and Engineering University of Maryland 4418 Stadium Drive College Park, MD 20742-2115 Mark Freitag City Manager P.O. Box 5005 Janesville, WI 53547-5005 Bill McCoy 1326 Putnam Avenue Janesville, WI 53546 Alfred Lembrich 541 Miller Avenue Janesville, WI 53548

ML22322A212 NRR-106 OFFICE NRR/DANU/PM NSIR/DPCP/BC NRR/DANU/BC NRR/DANU/PM NAME MBalazik BYip HCruz for (DHardesty for)

JBorromeo MBalazik DATE 11/18/2022 12/1/2022 12/2/2022 12/2/2022 OFFICE OF NUCLEAR SECURITY AND INCIDENT RESPONSE REGULATORY AUDIT TOPICS

SUMMARY

REPORT REGARDING CYBERSECURITY DESCRIBED IN SHINE OPERATING LICENSE APPLICATION SHINE TECHNOLOGIES, LLC DOCKET NO. 50-608

1.0 BACKGROUND

The U.S. Nuclear Regulatory Commission (NRC) staff is continuing its review of the SHINE Medical Technologies, LLC (SHINE) operating license application, submitted July 17, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19211C044), as supplemented by letters dated November 14, 2019 (ML19337A275),

March 27, 2020 (ML20105A295), August 28, 2020 (ML20255A027), November 13, 2020 (ML20325A026), December 10, 2020 (ML20357A084), and December 15, 2020 (ML21011A264). This regulatory audit is intended to assist the NRC staff in its review of cybersecurity topics described in the SHINE final safety analysis report (FSAR), submitted as part of SHINEs operating license application.

The NRC staff performed its audit in accordance with the regulatory audit plan provided to the licensee by letter dated June 10, 2021 (ML21161A116). The purpose of this regulatory was to review additional information necessary in determining that a reasonable assurance of adequate protection of public health and safety exist, that applicable regulatory requirements are met, and to identify information that requires docketing to support a regulatory finding regarding cybersecurity protection.

The audit entrance meeting was held on June 15, 2021, via teleconference. The audit included the NRC staffs review of docketed and non-docketed information via the SHINE electronic reading room (ERR) and teleconferences with SHINE.

Following the audit and prior to the issuance of this report, the NRC issued request for additional information (RAI) on August 13, 2021 (ML21210A438), as discussed in more detail below. On November 11, 2021 (ML21315A003) and July 7, 2022 (ML22223A065), SHINE submitted responses to these RAIs.

2.0 REGULATORY BASIS Regulatory Basis Paragraph (b) of 10 CFR 50.34, Contents of applications; technical information, states, in part, that [t]he final safety analysis report [FSAR] shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analysis of the structures, systems, and components and of the facility as a whole.

Enclosure

Paragraph (d) of 10 CFR 73.67, Licensee fixed site and in-transit requirements for the physical protection of special nuclear material of moderate and low strategic significance, includes requirements for fixed sites to control access to special nuclear material of moderate strategic significance.

Paragraph (a)(6) of 10 CFR 50.57, Issuance of operating license, states that an operating license may be issued upon finding, in part, that [t]he issuance of the license will not be inimical to the common defense and security or to the health and safety of the public.

3.0 AUDIT LOCATION AND DATES The audit was conducted via SHINEs ERR and a teleconference bridge Dates: June 15, 2021 Locations: SHINE ERR 4.0 NRC AUDIT TEAM MEMBERS Steven Lynch, Senior Project Manager Dan Warner, IT Specialist (Cyber)

Kim Lawson-Jenkins, IT Specialist (Cyber) 5.0 APPLICANT PARTICIPANTS Jeff Bartelme, SHINE Medical Technologies, LLC et al.

6.0 DESCRIPTION

OF AUDIT ACTIVITIES AND

SUMMARY

OF OBSERVATIONS The following information, as listed in the audit plan dated June 10, 2021 (ML21161A116), was reviewed, and discussed with the licensee:

Audit Topic 1 FSAR Sections 7.4.2.2.1 and 7.5.2.2.1 include criteria to prevent unauthorized physical and electronic access to CDAs [critical digital assets] in safety systems during the operational phase and during transition from development to operations. Section 7.4.5.3.2, Cyber Security Design Features, of the SHINE FSAR provides a description of the SHINE cybersecurity design for the safety systems, including references to the defensive system architecture, communication via one-way isolated channels, requirements for use of a maintenance workstation, and no remote access capabilities.

The NRC staffs observations:

Safety systems will be isolated and maintained within key locked cabinets in the facility control room through two levels of security, the facility access control and then the control room itself.

Control room is continuously manned.

Architecture: Limited ways to access the control system, need to use the maintenance workstation within the facility to access the programming and make changes, also need to use the rock creek architecture for the system to recognize the changes.

Criterion 2 for TRPS [target solution vessel reactivity protection system] and ESFAS

[engineered safety features actuation system] address the security controls for the systems.

No portable media access, no wired access outside of the facility.

Configuration control process used to address the future changes to the program.

Maintenance workstation is a chassis mounted touch screen computer mounted in a cabinet.

Hardwired through a cut wire switch into the control systems that needs to be activated to allow connection to the control system and then it is disabled once the changes are made. Any updates are handled through the engineering change process.

Board has to physically be removed to make any changes to the field programmable gate array (FPGA) logic. Uses something similar to a hashing function to verify changes to the bit stream for the FPGA devices that is only generated via a specific process at the RCI facilities.

No sort of cybersecurity program for operational technology currently planned at the SHINE facility.

The Cyber Security - Effective Practices for the Establishment and Maintenance of Adequate Cybersecurity at Non-Power (Research and Test) Reactor Facilities, was reviewed for information, but the applicant did not identify any of the practices that were incorporated into the facility for development.

SHINE referenced April 2017 meeting that the staff cant require a cybersecurity program.

Audit Topic 2 The physical security plan provides a description of the measures used to protect the facility and ensure the Category 2 material is secure including some of the digital computer and communication systems and networks used. However, it is unclear if any cybersecurity protections have been implemented to ensure these systems can perform their intended functions in the event of a cyber attack.

The NRC staffs observations:

The security system is stand alone and is not connected to other systems within the facility. Access level controls are password protected. Servers are in a controlled area, individual devices have temper switches where appropriate so that any attempt at access will result in an alarm. No access to untrusted networks from the security system.

Security software will also have tamper alarms for any unauthorized changes.

Three consecutive failed logins will result in an alarm.

Audit trail of last 50,000 commands that will be logged.

They receive generic cybersecurity awareness training.

Tablet for watchman is still being looked at to address if they can use it but they are not sure how to implement while ensuring protection of the systems at this point.

No network diagram for the system at this point.

7.0 Exit Briefing The NRC staff conducted an audit exit meeting via a teleconference on June 15, 2021. The NRC staff summarized its observations and described information needs that would likely be issued in a request for additional information as a result of the audit.

8.0 OPEN ITEMS AND PROPOSED CLOSURE PATHS Not applicable.

9.0 DEVIATIONS FROM THE AUDIT PLAN Not applicable.