ML18192B090
| ML18192B090 | |
| Person / Time | |
|---|---|
| Issue date: | 07/12/2018 |
| From: | Jim Beardsley Office of Nuclear Security and Incident Response |
| To: | Andersen J Office of Nuclear Security and Incident Response |
| PANTALO, CHARITY | |
| References | |
| Download: ML18192B090 (3) | |
Text
July 12, 2018 MEMORANDUM TO: Jim Andersen, Director Division of Physical and Cyber Security Policy Office of Nuclear Security and Incident Response FROM: Jim Beardsley, Branch Chief /RA/
Cyber Security Branch Division of Physical and Cyber Security Policy Office of Nuclear Security and Incident Response
SUBJECT:
CLOSEOUT OF NRC TEMPORARY INSTRUCTION 2201/004, INSPECTION OF IMPLEMENTATION OF INTERIM CYBER SECURITY MILESTONES 1-7 The objective of this temporary instruction was to assess and verify that the licensees implemented initial milestones of their cyber security program (otherwise known as milestones one through seven or MS 1-7) in accordance with the regulatory requirements of Title 10 of the Code of Federal Regulations (10 CFR) 73.54 and the licensees U.S. Nuclear Regulatory Commission (NRC) approved cyber security plan. Licensees committed to completing MS 1-7 by December 31, 2012. The staff conducted 63 MS 1-7 inspections during calendar years 2013, 2014 and 2015. The results of the inspections confirmed, in general, that the licensees implemented MS 1-7 per the requirements.
Observations from the MS 1-7 inspections identified some generic requirements that challenged licensees during the 3-year inspection period. Notably MS two (identifying critical digital assets) that made up of 19% of the violations in 2013, increasing to 31% of the violations in 2015. An example of a MS two violation is some licensees not identifying assets that had digital capabilities that if not protected could lead to a potential cyber attack vector. In MS four (portable media and mobile device (PMMD)) violations increased from 2013 to 2104 (25% to 35%) but returned to 25%
in 2015. An example of a MS four violation is licensees not maintaining consistent security levels security level controls on PMMD as related to the critical digital asset the PMMD supports. By 2015, licensee identified violations had increased from 37% of all violations in 2013 to 42%. That increase indicated to NRC staff that licensees operating experience from the earlier inspections was being used to more effectively and efficiently implement their cyber security programs.
CONTACT: Jim Beardsley, NSIR/DPCP/CSB (301) 287-0908
As a result of the MS 1-7 inspection generic, the staff and industry developed guidance to ensure that the issues were effectively resolved during the full implementation. This effort included the use of the security frequently asked question process, conduct of table top exercises and the development of addition industry guidance documents.
Most licensees completed the full implementation of their cyber security program (also known as MS 8) by December 2017. Full implementation inspections started in 2017 and will continue on to 2020. The NRC staff conducting these inspections are using NRC Inspection Procedure 71130.10P.
CLOSEOUT OF NRC TEMPORARY INSTRUCTION 2201/004, INSPECTION OF IMPLEMENTATION OF INTERIM CYBER SECURITY MILESTONES 1-7 DATE: July 12, 2018 DISTRIBUTION:
JAndersen DCurtis JBeardsley RCostello ADAMS ACCESSION NO.: ML18192B090 OFFICE NSIR/DPCP/CSB NAME JBeardsley DATE 07/12/2018 OFFICIAL RECORD COPY