ML14157A415

Ltr 06/06/14 Point Beach Cyber Security Request for Information

ML14157A415
Person / Time
Site:	Point Beach
Issue date:	06/06/2014
From:	Daley R C Engineering Branch 3
To:	McCartney E Point Beach
George Hausman
References
IR-14-403
Download: ML14157A415 (9)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION III 2443 WARRENVILLE RD. SUIT E 210 LISLE, IL 60532

-4352 June 6, 2014 Mr. Eric McCartney Site Vice President NextEra Energy Point Beach, LLC 6610 Nuclear Road Two Rivers, WI 54241

SUBJECT:

POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 - INFORMATION REQUEST FOR TEMPORARY INSTRUCTION 2201/004 INSPECTION

, NOTIFICATION TO PERFORM "INSPECTION OF IMPLEMENTATION OF INTERIM CYBER SECURITY MILESTONES 1 - 7"

Dear M r. McCartney:

O n August 25, 2014, the U.S.

Nuclear Regulatory Commission (NRC) will begin a n inspection of Temporary Instruction (TI) 2201/004 at you r Point Beach Nuclear Plant (PBNP), Units 1 and 2. The TI inspection will be performed to evaluate and verify your ability to meet the interim milestone requirements of the NRC's Cyber Security Rule , Title 10 , Code of Federal Regulations (CFR), Part 73, Section 54, "Protection of Digital Computer and Communication Systems and Networks."

In accordance with 10 CFR 73.54, each nuclear power plant licensee was required to submit a proposed Cyber Security Plan (CSP) and implementation schedule for NRC approval. On December 14, 2009, by letter (ML093080517) to the Nuclear Energy Institute (NEI), the NRC provided their expectations for the proposed implementation schedule. On January 5, 2011, by letter (ML11006009

3) to the NRC, NEI issued an initial "Template for the Cyber Security Plan Implementation Schedule" (ML110060097). On February 28, 2011, by letter (ML110600206) to the NRC, NEI provided a revised "Template for the Cyber Security Plan Implementation Schedule." Th e purpose of th e letter's attachment was to provide the licensee with a generically written template to develop their proposed CSP implementation schedule

. Utilization of the generic template require d the licensee to make conforming changes to ensure the submitted schedule accurately account ed for site-specific activities. Based on an NRC technical review (ML110070348), the template was found acceptable to develop the licensees' CSP implementation schedule (i.e., Milestone s 1 through 8). On March 31, 2011 , by letter (ML110950164) to the NRC, NextEra Energy provided a revised PBNP Implementation Schedule (Enclosure

3) and CSP (Enclosure 4). On July 21, 2011, by letter (ML111740077

), the NRC issued Amendment Nos. 2 43 (for Unit 1) and 247 (for Unit 2), which approved the P B NP CSP and associated implementation schedule.

In addition, both plant amendment s revised the existing facility operating licenses regarding physical protection to require the station to fully implement and maintain in effect all provisions of the NRC

-approved CSP. On November 23, 2012, by letter (ML12251A155), the NRC approved a change to the PBNP CSP Implementation Schedule's scope for Milestone 6 to include only the NEI 08-09, Revision 6,

E. McCartney Appendix D technical security controls and issued Amendment Nos. 247 and 251 for Units 1 and 2, respectively.

The subject TI inspection provides a programmatic level review and verification of the licensee's site-specific implementation of Interim Milestones 1 through 7. The schedule for the onsite TI Inspection for the Interim Milestones 1 through 7 is as follows:

Information Gathering Visit

August 25 - 2 9, 201 4; and Cyber Security T I Inspectio n: September 8 - 12 , 2 01 4 The purpose of the information gathering visit is to: (1) obtain information and documentation needed to support the TI inspection; (2) become familiar with your Cyber Security Program and plant layout; and (3) arrange administrative details, such as office space, availability of knowledgeable office personnel and to ensure unescorted site access privileges.

In order to assure a productive TI inspection, we have enclosed a request for documents needed to ensure that the inspectors are adequately prepared.

These documents have been divided into four groups. The first group lists information necessary to aid the inspectors in planning for the TI inspection. It is requested that this information be provided to the lead inspector via mail or electronically no later th an August 11 , 2 01 4. The second group also lists information and possible areas for discussion necessary to assist the inspectors during the TI inspection. It is requested this information be available during the information gathering visit (August 25 - 2 9 , 201 4). The third group of requested documents consists of those items that the inspectors will review, or need access to, during the TI inspection. Please have this information available by the first day of the onsite inspection week (September 8 , 201 4). The fourth group lists the information necessary to aid the inspectors in tracking questions and answers identified as a result of the TI inspection. It is requested that this information be provided to the lead inspector as the information is generated during the TI inspection. It is important that all of these documents are up to date and complete in order to minimize the number of additional documents requested during the preparation and/or the onsite portions of the TI inspection

. The lead inspector for this inspection is Mr. Gregory P. Hansen. We understand that our regulatory contact for this inspection is M r. Roger Clark of your organization. If there are any questions about the TI inspection or the material requested, please contact the lead inspector at (6 30) 829-9 610 or via e-mail at Gregory.Hansen@nrc.gov

. This letter does not contain new or amended information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection requirements were approved by the Office of Management and Budget, Control Number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid Office of Management and Budget Control Number.

E. McCartney In accordance with Title 10, Code of Federal Regulations (CFR), Part 2, Section 390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading

-rm/adams.html (the Public Electronic Reading Room).

Sincerely, /RA by D. Szwarc For/

Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket No(s).:

50-2 66; 50-30 1 License No(s).:

DPR-24, DPR-27

Enclosure:

Information Request for Cyber Security Temporary Instruction 2201/004 , Interim Milestones 1 - 7 Inspection cc w/encl: Distribution via LISTSERV

INFORMATION REQUEST FOR CYBER SECURITY TEMPORARY INSTRUCTION 2201/004 INTERIM MILESTONES 1 - 7 INSPECTION 1 Enclosure Inspection R epor t No s.: 05000 2 66/201 4 403; 05000 30 1/201 4 403 Inspection Onsite Dates: August 25 - 2 9 , 201 4 , (Information Gathering Visit) September 8 - 12 , 20 1 4 , (Cyber Security Temporary Instructions Inspection

) Inspection Procedure: Temporary Instruction 2201/004, "Inspection of Implementation of Interim Cyber Security (CS) Milestones 1 - 7" NRC Inspectors: Gregory P. Hansen , Lead Inspector George M. Hausman (630) 829-9 610 (630) 829-97 43 Gregory.Hansen@nrc.gov George.Hausman@nrc.gov Mark R. Rorabaugh (CS Contractor) (5 71) 2 62-9092 (cell) Mark.Rorabaugh@nrc.gov I. Information Requested Prior to the Information Gathering Visit The following information is requested b y August 11, 2014. If you have any questions regarding this request, please call the lead inspector as soon as possible. All information should be sent t o Mr. Gregory P. Hansen (e-mail address Gregory.Hansen@nrc.gov). Electronic media is preferred. Where information is provided that includes tables and/or lists of data or other such information

, please do not scan such tables and/or lists as images. The preferred file format is a searchable Excel spreadsheet or "pdf" file on a compact disk (CD). The CD should be indexed and hyper

-linked to facilitate ease of use. Please provide three copies of each CD submitted (one for each inspector and for a cyber security contractor

). A. Cyber Security Temporary Instruction Documentation NextEra Energy P B NP Cyber Security Plan Implementation Schedule

1. Provide a list of all documents required to complete each of the Cyber Security Milestones 1 through 7 identified by letter (ML110950164 , Enclosure s 3 and 4) dated March 31, 2011. Provide each milestone in a separate folder on the CD (e.g., Milestone 1, Milestone 2, etc.). Each milestone document shall be list ed in a table as follows:

MILESTONE X, where X equals 1 through 7 Document Number Title Description Rev Status No. 1 No. 2 No. 3 etc.

INFORMATION REQUEST FOR CYBER SECURITY TEMPORARY INSTRUCTION 2201/004 INTERIM MILESTONES 1 - 7 INSPECTION 2 Enclosure Based on the list of documents identified in I.A.1 above, for each milestone document where the "Status" is identified as complete d , place th e completed document in i t s associated folder and hyperlink the associated document number to th e completed document

. For each document

, the "Status" should be identified as "not started," "in

-progress" or "completed."

In addition to the documents identified in I.A.1 above, ensure the documents identified below (I.A.2 - I.A.8) for MILESTONE 1 - 7 are included in the I.A.1 table above. 2. MILESTON E 1 - Provide the following documentation for the Cyber Security Asse ssment Team (CSAT): a. Procedures establishing the CSAT team

. b. List of CSAT members noting primary areas of responsibility

. c. Procedures detailing qualification requirements for CSAT members

. d. Supporting documentation that demonstrates each CSAT member meets the requirements to fulfill their respective position on the team. For example, member resumes

evaluation of previous education and experience; training required by your implementing procedures and supporting documentation which shows training was completed; or industry certifications.

3. MILESTONE 2 - Provide the following documentation

a. List of plant system s noting which system s have been identified as critical systems (CSs)

. b. List of all digital assets noting which have been classified as Critical Digital Assets (CDAs) and which have not.

c. Procedure documenting the process by which CSs and CDAs are identified in accordance with (IAW) your CSP , Section 3.1.3. 4. MILESTONE 3 - Provide the following documentation

a. Procedures establishing your cyber defensive architecture. Explain any variances from your CSP, Section 4.3, and tracking documents for their correction.

b. Provide an overview of your cyber defensive architecture, preferably with overview level diagrams showing the various levels and location of the subject deterministic one

-way device.

c. Provide details of the implementation of the subject deterministic one

-way device.

INFORMATION REQUEST FOR CYBER SECURITY TEMPORARY INSTRUCTION 2201/004 INTERIM MILESTONES 1 - 7 INSPECTION 3 Enclosure 5. MILESTONE 4 - Provide the following documentation

a. Procedures implementing the security control "Access Control for Portable and Mobile Devices

." Include any training material or promotional literature distributed to staff associated with the control.

6. MILESTONE 5 - Provide the following documentation

a. Procedures implementing the requirements described in Milestone 5. b. Training materials associated with the changes to plant programs associated with Milestone 5. 7. MILESTONE 6 - Provide the following documentation

a. Procedures documenting the process by which technical cyber security controls have been identified for those CDAs which require the implementation of technical security controls for Milestone

6. 8. MILESTONE 7 - Provide the following documentation

a. Procedures implementing the ongoing monitoring and assessment activities as described in your CSP, Section 4.4. B. Cyber Security Supporting Documentation

1. Provide a copy of the current version of the updated safety analysis report (USAR), Technical Specifications (TS), and technical requirements manual (TRM) or equivalent.

2. Provide a copy of the current cyber security "Health Report," if available.

3. Provide a copy of the current plant drawings use d for operator training that provide additional information on system operation, system operating parameters, setpoints, etc. (e.

g., some licensee's refer to these drawings as "Horse Notes

") for identified cyber security CSs, if available.

4. Provide operator training lesson plans and/or operator training aids for identified cyber security CSs, if available.

II. Information Requested During the Information Gathering Visit (August 25 - 29 , 201 4) The following information is requested to be provided to the inspectors during the onsite information gathering visit.

It is requested that the following information be provided on three sets of CDs (searchable, if possible

). A. General Information

1. A listing of abbreviations and/or designators for plant systems; INFORMATION REQUEST FOR CYBER SECURITY TEMPORARY INSTRUCTION 2201/004 INTERIM MILESTONES 1 - 7 INSPECTION 4 Enclosure 2. Organization al chart for corporate and site personnel involved in establishing, overseeing

, and maintaining the cyber security program and; 3. A phone list for licensee personnel.

B. Facility Information:

1. Provide a presentation

/discussion of your CSP, existing cyber security CSs , and associated CDAs. 2. Provide a list and discussion of currently scheduled or planned cyber security related modifications to be installed in the plant.

C. Specific Information Associated with the Milestones:

1. MILESTONE 3 - Be prepared to provide an overview walkdown of the cyber architecture with in the plant including safety, security and emergency preparedness related CDA s. 2. MILESTONE 6 - Be prepared to present information for target set CDAs including a list of target set CDAs, and documentation of the process for identifying them.

3. MILESTONE 6 - For selected CDAs, be prepared to produce documentation for each of the technical controls in Appendix D of NEI 08-09 , Revision 6, the results of reviews required under your CSP, Section 3.1.6. a. For controls that are implemented, provide the procedures implementing the control. Common controls for all CDAs may be provided in a separate list with the procedures implementing each of them.

b. For alternate controls that have been implemented, provide the documented basis for employing alternative countermeasures, and the procedures implementing the alternative measures

. c. Where controls have been deemed unnecessary, provide the threat vector analysis supporting the conclusion that the threat vector does not exist. 4. MILESTONE 7 - For the CDAs selected above, be prepared to produce documentation for each of the technical controls in Appendix D of NEI 08-09 , Rev ision 6, and the results of immediate activities required under your CSP, Section 4.4. a. For all controls that are implemented, provide the objective evidence that the control is effective IAW your CSP, Section 4.4.3.1. This may be combined with the documentation provided for Milestone

6.

INFORMATION REQUEST FOR CYBER SECURITY TEMPORARY INSTRUCTION 2201/004 INTERIM MILESTONES 1 - 7 INSPECTION 5 Enclosure b. Documentation for common controls for all CDAs may be provided in a separate list with the procedures implementing each of them.

c. Provide governing procedures and results of vulnerability scans performed to comply with your CSP, Section 4.4.3.2 III. Information Requested to be Available on First D ay of the S econd Onsite W eek (September 8, 201 4) Th e following information is requested to be provided on the first day of the TI inspection. It is requested that th is information be provided on three sets of CDs (searchable, if possible).

A. Any updates to information previously provided.

IV. Information Requested to Be Provided Throughout the TI Inspection A. Copies of the list of questions

/documents requested identified by the inspector and the status/resolution of the information requested (provided daily during the TI inspection to each inspector). If you have questions regarding the information requested, please contact Mr. Gregory P. Hansen , the lead inspector.

K. Davison In accordance with Title 10 , Code of Federal Regulations (CFR), Part 2, Section 390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading

-rm/adams.html (the Public Electronic Reading Room).

Sincerely, /RA by D. Szwarc For/

Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket No (s).: 50-2 66; 50-30 1 License No(s).: D PR-24; DPR-27

Enclosure:

Information Request for Cyber Security Temporary Instruction 2201/004 , Interim Milestones 1 - 7 Inspection cc w/encl: Distribution via LISTSERV DISTRIBUTION

Joseph Nick RidsNrrDorlLpl3

-1 Resource RidsNrrPMPointBeach RidsNrrDirsIrib Resource Cynthia Pederson Darrell Roberts Steven Orth Allan Barker Carole Ariano Linda Linn DRPIII DRSIII Patricia Buckley Carmen Olteanu ROPreports.Resource@nrc.gov DOCUMENT NAME:

Ltr 0 6 0 5 14 Point Beach Cyber Security RFI GMH.docx Publicly Available Non-Publicly Available Sensitive Non-Sensitive To receive a copy of this document, indicate in the concurrence box "C" = Copy without attach/encl "E" = Copy with attach/encl "N" = No copy OFFICE RIII E RIII RIII RIII RIII NAME GHausman: ls RDaley DATE 0 6/06/1 4 0 6/06/1 4 OFFICIAL RECORD COPY