IR 05000346/2021401

Cyber Security Inspection Report 05000346/2021401 and Premliminary Greater than Green Finding and Apparent Violation

ML21277A311
Person / Time
Site:	Davis Besse
Issue date:	10/07/2021
From:	David Curtis Division of Reactor Safety III
To:	Tony Brown Energy Harbor Nuclear Corp
References
EA-21-105 IR 2121401
Download: ML21277A311 (5)

Text

October 7, 2021

SUBJECT:

DAVIS-BESSE NUCLEAR POWER STATION - CYBER SECURITY INSPECTION REPORT 05000346/2021401 AND PREMLIMINARY GREATER THAN GREEN FINDING AND APPARENT VIOLATION

Dear Mr. Brown:

On August 25, 2021, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Davis-Besse Nuclear Power Station (DBNPS) and discussed the results of this inspection with Mr. D. Benyak, Sr. Vice President, Fleet Nuclear Operations and other members of your staff. The results of this inspection are documented in the enclosed report.

The inspection examined activities conducted under your license as they relate to security and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The enclosed report documents a finding that has preliminarily been determined to be of Greater than Green, a finding of greater than very low safety significance, that may result in the need for further evaluation to determine significance and therefore the need for additional NRC action. As described in the enclosure of this report, you failed to incorporate certain aspects of your NRC approved Cyber Security Plan (CSP) to ensure compliance with NRC cyber security regulations. This finding was assessed based on the best available information, using the Physical Protection Significance Determination Process (PPSDP).

The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40-days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be closed for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40-days of your receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.

If you choose to send a response, it should be clearly marked as a "Response to An Apparent Violation; EA-21-105" and should include for the apparent violations: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response. Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-0001 with a copy to Mr. R. Skokowski, Branch Chief, Division of Reactor Safety, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Suite 210, Lisle, Illinois 60532-4352 within 40-days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a Regulatory Conference.

Please contact Mr. R. Skokowski at 630-829-9833 and in writing within 10-days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10-days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.

In addition, six findings of very low security significance (Green) are documented in this report.

All six of these findings involved violations of NRC requirements. We are treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy. If you contest the above six violations or the significance or severity of those violations documented in this inspection report, you should provide a response within 30-days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region III; the Director, Office of Enforcement; the Director, Office of Nuclear Security and Incident Response; and the NRC Resident Inspector at Davis-Besse Nuclear Power Station.

The following cross cutting aspects were assigned to findings using Inspection Manual Chapter 0310 Aspects Within Cross Cutting Areas: one [H.12] - Avoid Complacency, one

[H.13] - Consistent Process, one [H.14] - Conservative Bias, one [H.4] - Teamwork, one [H.8] - Procedure Adherence, and one [P.3] - Resolution.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30-days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region III; the Director, Office of Nuclear Security and Incident Response; and the NRC Resident Inspector at Davis-Besse Nuclear Power Station.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter will be made available electronically for public inspection in the NRC Public Document Room and in the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. However, the material enclosed herewith contains Security-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or in the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. If Security Related Information is necessary to provide an acceptable response, please mark your entire response Security-Related Information in accordance with 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390(b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response.

Sincerely, Signed by Curtis, David on 10/07/21 David Curtis, Acting Director Division of Reactor Safety Docket No. 05000346 License No. NPF-3 Enclosure:

As stated cc: C. Salz, State Liaison Officer Ohio Emergency Management Agency cc w/o encl: Distribution via LISTSERV ML21277A311 Entire Report: Non-Sensitive Publicly Available SUNSI Review Sensitive Non-Publicly Available Cover Letter Only: Non-Sensitive Publicly Available SUNSI Review Sensitive Non-Publicly Available OFFICE RIII RIII NSIR OE NSIR RIII NAME GHausman:mb GHansen JBeardsley JPeralta SLee JCameron DATE 10/04/2021 10/04/2021 10/05/2021 10/05/2021 10/05/2021 10/06/2021 OFFICE RIII NAME DCurtis DATE 10/07/2021