IR 05000397/2013406

IR 05000397-13-406, on 04/25/2013, Columbia Generating Station, NRC Temporary Instruction 2201/004, Inspection of Implementation of Interim Cyber Security Milestones 1-7, Inspection

ML13224A117
Person / Time
Site:	Columbia
Issue date:	08/12/2013
From:	Miller G B NRC/RGN-IV/DRS/EB-2
To:	Reddemann M E Energy Northwest
References
IR-13-406
Download: ML13224A117 (3)

Text

" " August 12, 2013

Mr. Mark Chief Executive Officer

Energy Northwest P.O. Box 968 (Mail Drop 1023)

Richland, WA 99352-0968

SUBJECT: COLUMBIA GENERATING STATION, NRC TEMPORARY INSTRUCTION 2201/004, "INSPECTION OF IMPLEMENTATION OF INTERIM CYBER SECURITY MILESTONES 1 - 7," INSPECTION REPORT 05000397/2013406

Dear Mr. Reddemann:

On April 25, 2013, the U.S. Nuclear Regulatory Commission (NRC) completed a security temporary instruction inspection at your Columbia Generating Station. The inspection covered the implementation of interim milestones associated with your cyber security program, as outlined in your approved cyber security plan and described in Temporary Instruction 2201/004, "Inspection of Implementation of Interim Cyber Security Milestones 1 - 7." The enclosed inspection report documents the inspection results, which were discussed telephonically on July 29, 2013, with Mr. Bradley Sawatzke, Vice President - Nuclear Generation, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, the NRC has identified three findings that were evaluated under the risk significance determination process as having very low significance. Two licensee-identified violations, which were determined to be of very low significance, are listed in this report in Section 4OA7. The NRC has determined that violations are associated with these findings; however, in accordance with the Security Issues Forum (SIF) Charter the NRC can exercise enforcement discretion during inspection of the interim cyber security measures for licensees who demonstrate a "good-faith interpretation" and attempt to implement Milestones 1 - 7. This discretion applies to licensees who have tried to implement the new UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV1600 EAST LAMAR BLVDARLINGTON, TEXAS 76011-4511 requirements, but failed to be in full compliance. The issues identified in this report were discussed and reviewed during the SIF meeting conducted on July 24, 2013. The results of the SIF Panel review concluded that although these issues constitute violations of 10 CFR 73.54, the NRC is not pursuing enforcement action because of your "good-faith" attempt to interpret and implement Milestones 1 - 7 and because of your prompt actions to enter these issues into your Corrective Action Program. As described in Enclosure 1 of NRC Enforcement Guidance Memorandum, "Guidance for Licensee Near-Term Corrective Actions to Address Cyber Security Inspection Findings and Licensee Eligibility for "Good- Faith" Attempt Discretion," dated April 26, 2013, Energy Northwest is requested to provide written notification to the NRC's regional office when the corrective actions for the identified issue(s) have been completed and closed.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter will be

available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). However, the material enclosed herewith contains Security-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRC's ADAMS. If you choose to provide a response and Security-Related Information is necessary to provide an acceptable response, please mark your entire response "Security-Related Information - Withhold from public disclosure under 10 CFR 2.390" in accordance with 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390 (b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response.

Sincerely,

/RA/ Geoffrey B. Miller, Chief Engineering Branch 2 Division of Reactor Safety

Docket No.: 50-397 License No.: NPF-21

Nonpublic Enclosure: NRC Inspection Report 05000397/2013406 w/Attachment: Supplemental Information

cc w/o enclosure: Electronic Distribution for Columbia Generating Station

ML13224A117 Cover Letter SUNSI Review STG Non Sensitive Sensitive STG Publicly Available Non-Publicly Available STG Cover Letter w/Enclosure SUNSI Review STG Non Sensitive Sensitive STG Publicly Available Non-Publicly Available STG SRI:DRS/EB2 RI:DRS/EB2 SI:DRS/PSB1 C:PBA C:EB2 SGraves SMakor JBuchanan WWalker GMiller /RA/ /RA/ E - STG /RA/ /RA/ 7/30/13 8/1/13 7/22/13 8/5/13 8/12/13