ML24061A057

Endorsement of NEI 08-09, Revision 7, Changes to NEI 08-09 Cyber Security Plan for Nuclear Power Reactors

ML24061A057
Person / Time
Site:	Nuclear Energy Institute
Issue date:	02/29/2024
From:	Mogavero R Nuclear Energy Institute
To:	Jeffrey Bream Document Control Desk, Office of Nuclear Security and Incident Response
References
ML24061A050
Download: ML24061A057 (1)

Text

Richard Mogavero Phone: 202.739.8174 Director, Incident Preparedness Email: rm@nei.org Technical & Regulatory Services

February 29, 2024

Mr. Jeffrey Bream Cybersecurity Branch Chief, Office of Nuclear Security and Incident Response U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Endorsement of NEI 08-09 Revision 7, Changes to NEI 08-09 Cyber Security Plan for Nuclear Power Reactors

Project Number: 689

Dear Mr. Bream:

By letters dated May 5, 20101 and June 7, 20102, the Nuclear Regulatory Commission (NRC) found the Nuclear Energy Institute (NEI)3 guidance document NEI 08-09, Cyber Security Plan for Nuclear Power Reactors, Revision 6, dated April 2010, acceptable for use by licensees to comply with the requirements of 10 CFR 73.54.

Lessons learned through the implementation of cyber security programs over the years indicated that guidance improvements were necessary to enhance clarity, enable efficient and consistent implementation, and to support NRC oversight activities. Accordingly, NEI, on behalf of our members, submitted, and NRC approved, several addenda to NEI 08-09, Revision 64 and processed a number of Security Frequently Asked Questions (SFAQs). Additionally, NEI revised, and NRC approved NEI 10-04,

1 ML101190371, NEI 08-09, Revision 6, Inclusion of definition of Cyber Attack

2 ML101550052, NEI 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors

3 The Nuclear Energy Institute (NEI) is responsible for establishing unified policy on behalf of its members relating to matters affecting the nuclear energy industry, including the regulatory aspects of generic operational and technical issues. NEIs members include entities licensed to operate commercial nuclear power plants in the United States, nuclear plant designers, major architect and engineering firms, fuel cycle facilities, nuclear materials licensees, and other organizations involved in the nuclear energy industry.

4 NEI 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors (ML101190371)

NEI 08-09, Revision 6, Inclusion of definition of Cyber Attack (ML10550052)

NEI 08-09, Revision 6, Addendum 1, Cyber Security Plan for Nuclear Power Reactors (ML17079A379)

NEI 08-09, Revision 6, Addendum 2, Detection, Response, Elimination (ML17212A630)

NEI 08-09, Revision 6, Addendum 3, System and Services Acquisition (ML17249A798)

NEI 08-09, Revision 6, Addendum 4, Physical and Operational Environment Protection (ML17212A630)

NEI 08-09, Revision 6, Addendum 5, Vulnerability Identification, Scoring and Screening (ML18226A004)

TVM Whitepaper, Remediation of Vulnerabilities Identified in CDAs (ML23072A063)

OMA Whitepaper, Ongoing Monitoring and Assessment (ML23205A200)

Mr. Jeffrey Bream Nuclear Energy Institute February 29, 2024 Page 2

Identifying Systems and Assets Subject to the Cyber Security Rule, Revision 3; and to NEI 13-10, Cyber Security Control Assessments, Revision 75.

NEI 08-09, Revision 7 incorporates previously approved guidance and aligns with approved changes in NEI 10-04 and NEI 13-10. Also included in this revision are several conforming and clarifying updates associated with cybersecurity fundamentals in threat and vulnerability management, wireless communication technologies, critical group criteria, and ongoing monitoring and assessment.

NEI requests that the NRC review and endorse NEI 08-09, Revision 7, dated February 2024, by August 1, 2024, under the fee exemption request approved January 17, 20236. While each licensee must review changes to their NRC staff approved Cyber Security Plan in accordance with the requirements of 10 CFR 50.54(p), NEI requests that NRCs review confirm that the changes proposed in NEI 08-09, Revision 7 do not decrease the effectiveness of the cyber security plan provided in NEI 08-09, Revision 6.

If any revisions to this document are desired, please include suggested wording and the technical data to support the proposed change(s).

If you have any questions or require additional information, please contact David Feitl at (202) 739-8115 or dff@nei.org, or me.

Sincerely,

Rich Mogavero Director, Security & Incident Preparedness

c: Mr. Brian Yip, NSIR/DSO, NRC Mr. Greg Bowman, NSIR/DPCP, NRC NRC Document Control Desk

Attachment(s):

NEI 08-09, Revision 7 NEI 08-09, Rev 7 Control Families with Attack Vector Classifications

5 NRC approval for NEI 10-04 Revision 3 and NEI 13-10 Revision 7 was completed in October 2021 and December 2021 respectively.

NEI 10-04, Revision 3, Identifying Systems and Assets Subject to the Cyber Security Rule (ML22112A072)

NEI 13-10, Revision 7, Cyber Security Control Assessments (ML22112A139)

6 Fee Exemption Request for NEI 08-09 Revision 7, Changes to NEI 08-09 Cyber Security Plan for Nuclear Power Reactors (ML22348A112)