IR 05000313/2024404: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
Line 1: Line 1:
{{Adams
{{Adams
| number = ML24099A191
| number = ML24242A217
| issue date = 04/08/2024
| issue date = 08/29/2024
| title = Information Request for the Cybersecurity Baseline Inspection, Notification to Perform Inspection (05000313/2024404 and 05000368/2024404)
| title = Cybersecurity Inspection Report 05000313/2024404 and 05000368/2024404
| author name = Graves S
| author name = Taylor N
| author affiliation = NRC/RGN-IV/DORS/EB2
| author affiliation = NRC/RGN-IV/DORS/EB2
| addressee name = Pehrson D
| addressee name = Pehrson D
| addressee affiliation = Entergy Operations, Inc
| addressee affiliation = Entergy Operations, Inc
| docket = 05000313, 05000368
| docket = 05000313, 05000368
| license number = DPR-051 , NPF-006
| license number = DPR-051, NPF-006
| contact person =  
| contact person =  
| document report number = IR 2024404
| document report number = IR 2024404
| document type = Inspection Plan, Letter
| document type = Inspection Report, Letter
| page count = 10
| page count = 9
}}
}}


Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:April 08, 2024
{{#Wiki_filter:August 29, 2024


==SUBJECT:==
==SUBJECT:==
ARKANSAS NUCLEAR ONE -- INFORMATION REQUEST FOR THE CYBERSECURITY BASELINE INSPECTION, NOTIFICATION TO PERFORM INSPECTION (05000313/2024404 AND 05000368/2024404)
ARKANSAS NUCLEAR ONE - CYBERSECURITY INSPECTION REPORT 05000313/2024404 AND 05000368/2024404


==Dear Doug Pehrson:==
==Dear Doug Pehrson:==
On August 19, 2024, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline inspection in accordance with Inspection Procedure (IP) 71130.10 Cybersecurity, at your Arkansas Nuclear One, Units 1 and 2. The inspection will be performed to evaluate and verify your ability to meet the requirements of the NRCs Cybersecurity Rule, Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, Protection of Digital Computer and Communication Systems and Networks.
On August 22, 2024, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Arkansas Nuclear One. On August 22, 2024, the NRC inspectors discussed the results of this inspection with Brian Patrick, Director, Regulatory & Performance Improvement and other members of your staff. The results of this inspection are documented in the enclosed report.


Experience has shown that baseline inspections are extremely resource intensive, both for the NRC inspectors and licensee staff. In order to minimize the inspection impact on the site and to ensure a productive inspection for both parties, we have enclosed a request for documents needed for the inspection. These documents have been divided into four groups.
No findings or violations of more than minor significance were identified during this inspection.


The first group specifies information necessary to assist the inspection team in choosing the focus areas (i.e., sample set) to be inspected by the IP 71130.10. This information should be made available either in an online repository (preferred) or digital media (CD/DVD) and delivered/available to the regional office no later than May 24, 2024. The inspection team will review this information and, by June 21, 2024, will request the specific items that should be provided for review.
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.


The second group of requested documents will assist the inspection team in the evaluation of the critical systems and critical digital assets (CSs/CDAs), defensive architecture, and the areas of your cybersecurity program selected for review. This information will be requested for review in the regional office prior to the inspection by July 19, 2024, as identified above. The third group of requested documents consists of additional items that the inspection team will review, or need access to, during the inspection. Please have this information available by the first day of the onsite inspection, August 19, 2024.
Sincerely, Nicholas H. Taylor, Chief Engineering Branch 2 Division of Operating Reactor Safety Docket Nos. 05000313, 05000368 License Nos. DPR-51, NPF-6


The fourth group of information aids the inspection team in tracking issues identified during the inspection. It is requested that this information be provided to the lead inspector as the information is generated during the inspection. It is important that all requested documents are up to date and complete to minimize the number of additional documents requested during the preparation and/or the onsite portions of the inspection.
===Enclosure:===
As stated


The lead inspector for this inspection is Sam Graves. We understand that our regulatory contact for this inspection is Michael Hall of your organization. If there are any questions about the inspection or the material requested, please contact the lead inspector at 817-200-1102 or via e-mail at samuel.graves@nrc.gov.
==Inspection Report==
Docket Numbers: 05000313 and 05000368


Paperwork Reduction Act Statement This letter contains mandatory information collections that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). The Office of Management and Budget (OMB)
License Numbers: DPR-51 and NPF-6
approved these information collections under approval number 3150-0011. The burden to the public for these information collections is estimated to average 40 hour(s) per response. Send comments regarding this information collection to the FOIA, Library and Information Collection Branch, Office of the Chief Information Officer, Mail Stop: T6-A10M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by email to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0011)
OMB, Washington, DC 20503.


Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid Office of Management and Budget control number.
Report Numbers: 05000313/2024404 and 05000368/2024404


In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Enterprise Identifier: I-2024-404-0010


Sincerely, Sam Graves, Senior Reactor Inspector Engineering Branch 2 Division of Operating Reactor Safety Signed by Graves, Samuel on 04/08/24 Docket Nos. 05000313, 05000368 License Nos. DPR-51, NPF-6 Enclosure: Arkansas Nuclear One, Units 1 And 2 Cybersecurity Inspection Document Request
Licensee: Entergy Operations, Inc.


ML24099A191 SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword:
Facility: Arkansas Nuclear One
By: STG Yes No Publicly Available Sensitive NRC-002 OFFICE RIV:SRI/DORS/EB2


NAME S. Graves
Location: Russellville, AR


SIGNATURE /RA/
Inspection Dates: August 19, 2024, to August 22, 2024


DATE 04/08/24
Inspectors: J. Drake, Senior Reactor Inspector S. Graves, Senior Reactor Inspector


ARKANSAS NUCLEAR ONE CYBERSECURITY INSPECTION DOCUMENT REQUEST
Approved By: Nicholas H. Taylor, Chief Engineering Branch 2 Division of Operating Reactor Safety


Inspection Report: 05000313/2024404; 05000368/2024404
Enclosure


Inspection Dates: Week of August 19, 2024
=SUMMARY=
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a cybersecurity inspection at Arkansas Nuclear One, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.


Inspection Procedure: IP 71130.10, CYBERSECURITY
===List of Findings and Violations===
No findings or violations of more than minor significance were identified.


Reference: ML21330A088, Guidance Document for Development of the Request for Information (RFI) and Notification Letter for IP 71130.10 Cyber Security Inspection, Revision 2
===Additional Tracking Items===
None.


NRC Inspectors:
=INSPECTION SCOPES=


Sam Graves, Lead James Drake 817-200-1102 817-200-1558 samuel.graves@nrc.gov james.drake@nrc.gov
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2201, Security Inspection Program for Commercial Nuclear Power Reactors. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.


CSB Liaison:
==SAFEGUARDS==
Mario Fernandes mario.fernandez@nrc.gov
==71130.10 - Cybersecurity==
===Cybersecurity (1 Sample)===
: (1) The team reviewed implementation of Arkansas Nuclear Ones Cybersecurity Plan (CSP) and focused on evaluating changes to the program, critical systems, and critical digital assets (CDAs).


NRC Contractors:
The following IP sections were completed and constitute completion of 1 sample:
* 03.01, Review Ongoing Monitoring and Assessment Activities
* 03.02, Verify Defense-in-Depth Protective Strategies (Partial)
* 03.03, Review of Configuration Management Change Control (Partial)
* 03.04, Review of Cyber Security Program (Partial)
* 03.05, Evaluation of Corrective Actions


Justin Bowden Trace Coleman 301-415-7000 301-415-7000 justin.bowden@nrc.gov trace.coleman@nrc.gov
The inspection reviewed the following cybersecurity program change:
* EC-54065725 Sallyport Security and Cybersecurity Upgrades


I. Information Requested for In-Office Preparation
The team reviewed boundary device configurations, procedures and processes, staff training, and incident response implementation procedures.
* C619-DD 4 (Canary CT20SD)
* C629-NIDS-0000626856 (M920 IPS-NS3200 /M920)
* SIEM (Level 2) SPLUNK


This initial request for information (i.e., Table RFI #1) concentrates on providing the inspection team with information necessary to select appropriate components and cybersecurity program elements to develop a site-specific inspection plan. The first RFI is used to identify the critical digital assets or systems to be chosen as the sample set required to be inspected by the cybersecurity IP. The first RFIs requested information is specified below in Table RFI #1.
The team also reviewed the following CDAs and their coverage by the cybersecurity plan.
* C618-ADA (PA Active Directory Server)
* 2C324-IDS1 (Level 3 NIDS McAfee IPS-NS3200 Dell R610)


Please provide the information requested in Table RFI #1 to the regional office by May 24, 2024, or sooner, to facilitate the selection of the specific items for review.
==INSPECTION RESULTS==
No findings were identified.


The inspection team will examine the documentation from the first RFI and select specific systems and equipment to provide a more focused follow-up request to develop the second RFI.
==EXIT MEETINGS AND DEBRIEFS==
The inspectors verified no proprietary information was retained or documented in this report.
* On August 22, 2024, the inspectors presented the cyber security inspection results to Brian Patrick, Director, Regulatory & Performance Improvement and other members of the licensee staff.


The inspection team will submit the specific systems and equipment list to your staff by June 21, 2024, which will be utilized to evaluate the equipment, defensive architecture, and the areas of the licensees cybersecurity program for review.
=DOCUMENTS REVIEWED=


Please provide the information requested by the second RFI to the regional office by
Inspection Type Designation Description or Title Revision or
 
Procedure Date
Enclosure July 19, 2024. All requests for information shall follow the guidance document referenced above. For information requests that have more than ten (10) documents, please provide a compressed (i.e., Zip) file of the documents.
71130.10 Corrective Action CR-ANO-C-2022-02184, C-2023-00106, C-2023-00386, C-2023-
 
Documents 00390, C-2023-00425, C-2023-00427, C-2023-00429, C-
The required Table RFI #1 information shall be provided in an online document repository or on digital media (CD/DVD) to the lead inspector by May 24, 2024. The preferred file format for all lists is a searchable Excel spreadsheet file. The information should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please contact the inspection team leader as soon as possible
23-00432, C-2023-00433, C-2023-00434, C-2023-00435,
 
C-2023-00436, C-2023-00437, C-2024-00580, C-2024-
Table RFI #1
00581, C-2023-00109, C-2024-01401, C-2024-01402, C-
 
24-01403, C-2024-01404, C-2024-01407, C-2024-01415,
Section 3,
CR-HQN-2022-01377, 2023-00042, 2023-00146, 2023-00161, 2023-
 
00486, 2023-03651, 2024-00285, 2024-00893
Paragraph Number/Title: IP Ref. Items
Corrective Action CR-ANO-C-2024-01428, C-2024-01429, C-2024-01442, C-2024-
 
Documents 01444
1 A list of all Identified Critical Systems and Critical Digital Assets, - Overall highlight/note any additions, deletions, reclassifications due to new guidance from white papers, changes to NEI 10-04, 13-10, etc. since the last cybersecurity inspection.
Resulting from CR-HQN-2024-00907, 2020-00908, 2024-00914, 2024-00915
 
Inspection
2 A list of EP and Security onsite and offsite digital communication systems Overall (Provide EP asset list only if you have NOT reclassified items)
Miscellaneous EN-IT-103-08 Attachment 2 for L3 Kiosk (Unannounced drill)1/11/2023
 
ANO-CDA-1902-NEI 13-10 Indirect CDA Assessment - Level 3 Remediation
3 Network Topology Diagrams to include information and data flow for critical Overall systems in levels 2, 3 and 4 (If available)
00009 Rack CDAs
 
ANO-CDA-1905-C619-DD PA Security Data Diode (SEC ANO1)
4 Ongoing Monitoring and Assessment program documentation 03.01(a)
00017
 
ANO-CDA-2007-SIEM white paper and assessment combined document.
5 The most recent effectiveness analysis and self-assessments of the 03.01(b)
00006
Cybersecurity Program
CDA-1701-00204 Technical Controls 08-09 Assessment
 
CDA-2211-00003 Plant Monitoring Computer System NEI 13-10 EP and
6 Portable Media and Mobile Device control documentation, including kiosk 03.02(e)
Indirect Combined Assessment
security control assessment/documentation
CDA-2311-00001 Sally Port Security Equipment NEI 08-09 Direct Assessment
 
Checklist OIT-Employee Off Boarding - Account Management 08/28/2023
7 Design change/modification program documentation and a list of all cyber- 03.03(a)
F-BIT-SQA Software Quality Assurance (SQA} Training 0
related design changes completed since the last two cybersecurity inspections, including either a summary describing the design change or the 50.59 documentation for the change.
FCBT-BIT-SQA Software Quality Assurance (SQA} Training 0
 
FCBT-CSG-Generic Cyber Security Awareness 2
8 Supply Chain Management documentation including any security impact 03.03(a), (b)
CSCNAN
analysis for new acquisitions and (c)
FCBT-ESPP-Maintain Cyber Security Technical Controls 0
 
CYBRINV
9 Cybersecurity Plan and any 50.54(p) analysis to support changes to the plan 03.04(a)
FCBT-ESPP-Cyber Security Walkdowns 0
since the last inspection
WLKDWN
 
Inspection Type Designation Description or Title Revision or
10 Cybersecurity Metrics tracked (if applicable) 03.06 (b)
Procedure Date
 
FCBT-GET-PDM Control of Portable Digital Media 9
ARKANSAS NUCLEAR ONE CYBERSECURITY INSPECTION DOCUMENT REQUEST
FCBT-IT-CSAT Security Assessment Team (CSAT) Activities 0
 
FCBT-lT-NCIRT Nuclear Cyber Incident Response Team 0
Table RFI #1
FCBT-SEC-CSGI Protection Of Unclassified Safeguards & Safeguards 9
 
Information-Modified Handling
Section 3,
FFAM-IT-CDAA Job Familiarization Guide for Perform CDA Assessor 0
 
Activities
Paragraph Number/Title: IP Ref. Items
FFAM-IT-Portable Digital Media Lap11op Hardening and Scanning 1
 
LAPHARDN
11 Provide copies of all cybersecurity program related procedures and policies Overall with their descriptive name and associated number (if available)
FFAM-IT-Portable Digital Media Kiosk Maintenance and Media 1
 
MEDIASCAN Scanning
12 Performance testing report (if applicable) 03.06 (a)
FLP-ESP-CDA Critical Digital Asset Assessor 2
 
LO-ALO-2023-Cyber Security Program Effectiveness Review
13 Corrective actions taken as a result of cybersecurity incidents/issues to 03.05 include previous NRC violations and Licensee Identified Violations since two previous cybersecurity inspections
00040
 
SIEM White White paper describing Entergys site Cyber Security
In addition to the above information please provide the following:
Paper Monitoring System (CSMS)
 
Whitepaper Vulnerability Management Recovery Plan - 2024 ANO
(1) Electronic copy of the UFSAR, technical specifications, and Operating Licenses.
Inspection
 
Whitepaper XR-Actions taken on Northpoint Receiving Warehouse X-Ray
(2) Name(s) and phone numbers for the regulatory and technical contacts.
Machine
 
WT-WTANO-Level Specific Firmware Protected Devices 05/20/2023
(3) Current management and engineering organizational charts.
23-00152
 
Procedures 0CAN021802 ANO Cyber Security Plan Arkansas Nuclear One - Units 1 2
Based on this information, the inspection team will identify and select specific systems and equipment (e.g., CSs/CDAs) from the information requested by Table RFI #1 and submit a list of specific systems and equipment to your staff by June 21, 2024, for the second RFI (i.e., RFI #2).
and 2 Docket Nos. 50-313 and 50-368
 
CSWI-1250 Change CDA Passwords Work Instructions 12/20/2018
II. Additional Information Requested to be Available Prior to Inspection.
CSWI-1255 Review of Audit Log Records (Logical) Work Instructions 3
 
CSWI-1270 Account Management Work Instructions 4
As stated in Section I above, the inspection team will examine the returned documentation requested from Table RFI #1 and submit the list of specific systems and equipment to your staff by June 21, 2024, for the second RFI (i.e., RFI #2). The second RFI will request additional information required to evaluate the CSs/CDAs, defensive architecture, and the areas of the licensees CSP selected for the cybersecurity inspection. The additional information requested for the specific systems and equipment is identified in Table RFI #2. All requested information shall follow the guidance document referenced above.
CSWI-1280 Monthly Operational Review and Verification of the SIEM 10/8/2020
 
Infrastructure Work Instructions
The Table RFI #2 information shall be provided in an online document repository or on digital media (CD/DVD) to the lead inspector by July 19, 2024. The preferred file format for all lists is a searchable Excel spreadsheet file. The information should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please contact the inspection team leader as soon as possible
EN-EP-202-01 ANO EITER (Equipment Important To Emergency 2
 
Response) Matrix
ARKANSAS NUCLEAR ONE CYBERSECURITY INSPECTION DOCUMENT REQUEST
EN-IT-103-01 Control of Portable Digital Media Connected to Critical Digital 14
 
Assets
Table RFI #2
EN-IT-103-02 Cyber Security Periodic Activities 8
 
Inspection Type Designation Description or Title Revision or
Section 3, IP Ref.
Procedure Date
 
EN-IT-103-06 Audit & Accountability 1
Paragraph Number/Title: Items
EN-IT-103-12 Cyber Security Configuration and Change Management 4
 
EN-IT-103-14 Vulnerability Management 2
For the system(s) chosen for inspection provide:
EN-IT-104 Software Quality Assurance Program 16
 
EN-TQ-131 Nuclear Cyber Security Training & Qualifications 3
1 Ongoing Monitoring and Assessment activity performed on the selected 03.01(a)
Work Orders 54137012, 54126919, 54115753, 54067379
system(s)
 
2 All Security Control Assessments for the selected system(s) 03.01(a)
 
3 All vulnerability screenings/assessments associated with, or scans 03.01(c)
performed on the selected system(s) since the last cybersecurity inspection
 
Documentation (including configuration files and rules sets) for Network-4 based Intrusion Detection/Protection Systems (NIDS/NIPS), Host-based Intrusion Detection Systems (HIDS), and Security Information and Event 03.02(b)
Management (SIEM) systems for system(s) chosen for inspection
 
Documentation (including configuration files and rule sets) for intra-security 5 level firewalls and boundary devices used to protect or isolate the selected 03.02(c)
system(s)
 
6 Copies of all periodic reviews of the access authorization list for the selected 03.02(d)
systems since the last inspection
 
7 Baseline configuration information for the selected CDAs 03.03(a)
 
8 Documentation of any changes, including Security Impact Analyses, 03.03(b)
performed on the selected system(s) since the last inspection
 
9 Copies of the purchase order documentation for any new equipment 03.03(c)
purchased for the selected systems since the last inspection
 
10 Copies of any reports/assessment for cybersecurity drills performed since 03.02(a)
the last inspection. 03.04(b)
 
11 Copy of the individual recovery plan(s) for the selected system(s) including 03.02(a)
documentation of the results the last time the backups were executed. 03.04(b)
 
12 Vulnerability screening/assessment and scan program documentation 03.01(c)
 
13 Cybersecurity Incident response documentation, including incident 03.02(a)
detection, response, and recovery documentation as well as contingency and plan development, implementation and including any program 03.04(b)
documentation that requires testing of security boundary device functionality
 
14 Device Access and Key Control documentation 03.02(c)
 
15 User Account/Credential documentation 03.02(d)
 
ARKANSAS NUCLEAR ONE CYBERSECURITY INSPECTION DOCUMENT REQUEST
 
Table RFI #2
 
Section 3, IP Ref.
 
Paragraph Number/Title: Items
 
16 Password/Authenticator documentation 03.02(c)
 
17 Portable Media and Mobile Device control documentation, including 03.02(e)
Scanning Station/Kiosk security control assessment/documentation
 
18 Configuration Management documentation including any security impact 03.03(a)
analysis performed due to configuration changes since the last inspection and (b)
 
19 Provide documentation describing any cybersecurity changes to the access Overall authorization program since the last cybersecurity inspection.
 
III. Information Requested to be Available on First Day of Inspection
 
For the specific systems and equipment identified in Section II above, provide the following RFI (i.e., Table - Onsite Week) to the team by August 19, 2024, the first day of the inspection. All requested information shall follow the guidance document referenced above.
 
The preferred file format for all lists is a searchable Excel spreadsheet file. The information should be indexed and hyper-linked to facilitate ease of use. If you have any questions regarding this information, please contact the inspection team leader as soon as possible.
 
Table - Onsite Week
 
Section 3, Paragraph Number/Title: Items
 
1 Any cybersecurity event reports submitted in accordance with 03.04(a)
10 CFR 73.77 since the last cybersecurity inspection
 
Updated Copies of corrective actions taken as a result of cyber 2 security incidents/issues, to include previous NRC violations and 03.04(d)
Licensee Identified Violations since the last cybersecurity inspection, as well as vulnerability-related corrective actions
 
In addition to the above information please provide the following:
 
(1) Copies of the following documents do not need to be solely available to the inspection team as long as the inspectors have easy and unrestrained access to them:
 
a. Updated Final Safety Analysis Report, if not previously provided;
 
b. Original SER and Supplements related to cybersecurity;
 
c. FSAR Question and Answers related to cybersecurity;
 
ARKANSAS NUCLEAR ONE CYBERSECURITY INSPECTION DOCUMENT REQUEST
 
d. Quality Assurance Plan;
 
e. Technical Specifications, if not previously provided;
 
f. Operating License(s), if not previously provided.
 
(2) Vendor Manuals, Assessments and Corrective Actions:
 
a. The most recent Cybersecurity Quality Assurance (QA) audit and/or self-assessment; and
 
b. Corrective action documents (e.g., condition reports, including status of corrective actions) generate as a result of the most recent Cybersecurity Quality Assurance (QA) audit and/or self-assessment.
 
IV. Information Requested To Be Provided Throughout the Inspection
 
(1) Copies of any corrective action documents generated as a result of the inspection teams questions or queries during the inspection.
 
(2) Copies of the list of questions submitted by the inspection team members and the status/resolution of the information requested (provided daily during the inspection to each inspection team member).
 
If you have any questions regarding the information requested, please contact the inspection team leader.


7
7
}}
}}

Revision as of 05:52, 14 September 2024

Cybersecurity Inspection Report 05000313/2024404 and 05000368/2024404
ML24242A217
Person / Time
Site: Arkansas Nuclear  Entergy icon.png
Issue date: 08/29/2024
From: Nick Taylor
NRC/RGN-IV/DORS/EB2
To: Pehrson D
Entergy Operations
References
IR 2024404
Download: ML24242A217 (9)
v • d • e


Text

August 29, 2024

SUBJECT:

ARKANSAS NUCLEAR ONE - CYBERSECURITY INSPECTION REPORT 05000313/2024404 AND 05000368/2024404

Dear Doug Pehrson:

On August 22, 2024, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Arkansas Nuclear One. On August 22, 2024, the NRC inspectors discussed the results of this inspection with Brian Patrick, Director, Regulatory & Performance Improvement and other members of your staff. The results of this inspection are documented in the enclosed report.

No findings or violations of more than minor significance were identified during this inspection.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely, Nicholas H. Taylor, Chief Engineering Branch 2 Division of Operating Reactor Safety Docket Nos. 05000313, 05000368 License Nos. DPR-51, NPF-6

Enclosure:

As stated

Inspection Report

Docket Numbers: 05000313 and 05000368

License Numbers: DPR-51 and NPF-6

Report Numbers: 05000313/2024404 and 05000368/2024404

Enterprise Identifier: I-2024-404-0010

Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One

Location: Russellville, AR

Inspection Dates: August 19, 2024, to August 22, 2024

Inspectors: J. Drake, Senior Reactor Inspector S. Graves, Senior Reactor Inspector

Approved By: Nicholas H. Taylor, Chief Engineering Branch 2 Division of Operating Reactor Safety

Enclosure

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a cybersecurity inspection at Arkansas Nuclear One, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

No findings or violations of more than minor significance were identified.

Additional Tracking Items

None.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2201, Security Inspection Program for Commercial Nuclear Power Reactors. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

SAFEGUARDS

71130.10 - Cybersecurity

Cybersecurity (1 Sample)

(1) The team reviewed implementation of Arkansas Nuclear Ones Cybersecurity Plan (CSP) and focused on evaluating changes to the program, critical systems, and critical digital assets (CDAs).

The following IP sections were completed and constitute completion of 1 sample:

  • 03.01, Review Ongoing Monitoring and Assessment Activities
  • 03.02, Verify Defense-in-Depth Protective Strategies (Partial)
  • 03.03, Review of Configuration Management Change Control (Partial)
  • 03.05, Evaluation of Corrective Actions

The inspection reviewed the following cybersecurity program change:

  • EC-54065725 Sallyport Security and Cybersecurity Upgrades

The team reviewed boundary device configurations, procedures and processes, staff training, and incident response implementation procedures.

  • C619-DD 4 (Canary CT20SD)
  • C629-NIDS-0000626856 (M920 IPS-NS3200 /M920)
  • SIEM (Level 2) SPLUNK

The team also reviewed the following CDAs and their coverage by the cybersecurity plan.

  • C618-ADA (PA Active Directory Server)
  • 2C324-IDS1 (Level 3 NIDS McAfee IPS-NS3200 Dell R610)

INSPECTION RESULTS

No findings were identified.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

  • On August 22, 2024, the inspectors presented the cyber security inspection results to Brian Patrick, Director, Regulatory & Performance Improvement and other members of the licensee staff.

DOCUMENTS REVIEWED

Inspection Type Designation Description or Title Revision or

Procedure Date

71130.10 Corrective Action CR-ANO-C-2022-02184, C-2023-00106, C-2023-00386, C-2023-

Documents 00390, C-2023-00425, C-2023-00427, C-2023-00429, C-

23-00432, C-2023-00433, C-2023-00434, C-2023-00435,

C-2023-00436, C-2023-00437, C-2024-00580, C-2024-

00581, C-2023-00109, C-2024-01401, C-2024-01402, C-

24-01403, C-2024-01404, C-2024-01407, C-2024-01415,

CR-HQN-2022-01377, 2023-00042, 2023-00146, 2023-00161, 2023-

00486, 2023-03651, 2024-00285, 2024-00893

Corrective Action CR-ANO-C-2024-01428, C-2024-01429, C-2024-01442, C-2024-

Documents 01444

Resulting from CR-HQN-2024-00907, 2020-00908, 2024-00914, 2024-00915

Inspection

Miscellaneous EN-IT-103-08 Attachment 2 for L3 Kiosk (Unannounced drill)1/11/2023

ANO-CDA-1902-NEI 13-10 Indirect CDA Assessment - Level 3 Remediation

00009 Rack CDAs

ANO-CDA-1905-C619-DD PA Security Data Diode (SEC ANO1)

00017

ANO-CDA-2007-SIEM white paper and assessment combined document.

00006

CDA-1701-00204 Technical Controls 08-09 Assessment

CDA-2211-00003 Plant Monitoring Computer System NEI 13-10 EP and

Indirect Combined Assessment

CDA-2311-00001 Sally Port Security Equipment NEI 08-09 Direct Assessment

Checklist OIT-Employee Off Boarding - Account Management 08/28/2023

F-BIT-SQA Software Quality Assurance (SQA} Training 0

FCBT-BIT-SQA Software Quality Assurance (SQA} Training 0

FCBT-CSG-Generic Cyber Security Awareness 2

CSCNAN

FCBT-ESPP-Maintain Cyber Security Technical Controls 0

CYBRINV

FCBT-ESPP-Cyber Security Walkdowns 0

WLKDWN

Inspection Type Designation Description or Title Revision or

Procedure Date

FCBT-GET-PDM Control of Portable Digital Media 9

FCBT-IT-CSAT Security Assessment Team (CSAT) Activities 0

FCBT-lT-NCIRT Nuclear Cyber Incident Response Team 0

FCBT-SEC-CSGI Protection Of Unclassified Safeguards & Safeguards 9

Information-Modified Handling

FFAM-IT-CDAA Job Familiarization Guide for Perform CDA Assessor 0

Activities

FFAM-IT-Portable Digital Media Lap11op Hardening and Scanning 1

LAPHARDN

FFAM-IT-Portable Digital Media Kiosk Maintenance and Media 1

MEDIASCAN Scanning

FLP-ESP-CDA Critical Digital Asset Assessor 2

LO-ALO-2023-Cyber Security Program Effectiveness Review

00040

SIEM White White paper describing Entergys site Cyber Security

Paper Monitoring System (CSMS)

Whitepaper Vulnerability Management Recovery Plan - 2024 ANO

Inspection

Whitepaper XR-Actions taken on Northpoint Receiving Warehouse X-Ray

Machine

WT-WTANO-Level Specific Firmware Protected Devices 05/20/2023

23-00152

Procedures 0CAN021802 ANO Cyber Security Plan Arkansas Nuclear One - Units 1 2

and 2 Docket Nos. 50-313 and 50-368

CSWI-1250 Change CDA Passwords Work Instructions 12/20/2018

CSWI-1255 Review of Audit Log Records (Logical) Work Instructions 3

CSWI-1270 Account Management Work Instructions 4

CSWI-1280 Monthly Operational Review and Verification of the SIEM 10/8/2020

Infrastructure Work Instructions

EN-EP-202-01 ANO EITER (Equipment Important To Emergency 2

Response) Matrix

EN-IT-103-01 Control of Portable Digital Media Connected to Critical Digital 14

Assets

EN-IT-103-02 Cyber Security Periodic Activities 8

Inspection Type Designation Description or Title Revision or

Procedure Date

EN-IT-103-06 Audit & Accountability 1

EN-IT-103-12 Cyber Security Configuration and Change Management 4

EN-IT-103-14 Vulnerability Management 2

EN-IT-104 Software Quality Assurance Program 16

EN-TQ-131 Nuclear Cyber Security Training & Qualifications 3

Work Orders 54137012, 54126919, 54115753, 54067379

7

Retrieved from "https://kanterella.com/w/index.php?title=IR_05000313/2024404&oldid=3667769"