IR 05000346/2016409

Davis-Besse Nuclear Power Station, Unit 1 - Cyber Security Problem and Identification Inspection Report 05000346/2016409 - Cover Letter Only (IAK)

ML16348A496
Person / Time
Site:	Davis Besse
Issue date:	12/12/2016
From:	Daley R C Engineering Branch 3
To:	Boles B D FirstEnergy Nuclear Operating Co
References
IR 2016409
Download: ML16348A496 (4)

Text

December 12, 2016

Mr. Brian Boles Site Vice President FirstEnergy Nuclear Operating Co. Davis-Besse Nuclear Power Station 5501 N. State Rte. 2, Mail Stop ADB3080 Oak Harbor, OH 434499760 SUBJECT: DAVIS-BESSE NUCLEAR POWER STATION, UNIT 1 - CYBER SECURITY PROBLEM AND IDENTIFICATION INSPECTION REPORT 05000346/2016409

Dear Mr. Boles:

On November 3, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed a Cyber Security Inspection at your Davis-Besse Nuclear Power Plant, Unit 1. The enclosed inspection report documents the inspection results, which were discussed on November 3, 2016, with Mr. G. Wolf and other members of your staff. The inspection examined activities conducted under your license as they relate to cyber-security of your license. The inspector reviewed selected procedures and records, observed activities, and interviewed personnel. The NRC inspector documented one finding of very low safety significance (Green) in this report. This finding involved a violation of NRC requirements. The NRC is treating this violation as a Non-Cited Violation consistent with Section 2.3.2 of the Enforcement Policy. However, in accordance with the Security Issues Forum (SIF) Charter, the NRC may exercise enforcement discretion during inspection of the interim cyber security measures for licensees who - 7. This discretion applies to licensees who have tried to implement the new requirements, but failed to be in full compliance. Before discretion is considered or granted for any issue, licensees must accept the finding, put the finding into their Corrective Action Program, and take appropriate corrective action once identified. This issue was discussed and reviewed during the SIF Meeting conducted on October 19, 2016. The results of the SIF Panel review concluded that although this issue constituted a violation of your facility operating license and Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, the NRC is exercising enforcement discretion. The NRC is not taking enforcement action for this violation because it meets the criteria established in an NRC memorandum from Barry C. Westreich, Director, Cyber Security Directorate, Office of Nuclear Security and Incident Response, to each regional office Enclosure contains Sensitive Unclassified Non-Safeguards Information. When separated from enclosure, this transmittal document is decontrolled. and Director, Division of Reactor Safety, Subject: Enhanced Guidance for Licensee Near-Term Corrective Actions to Address Cyber Security Inspection Findings and Licensee Eligibility for -ttempt Discretion dated July 1, 2013, (ADAMS Accession Number ML13178A203). Consistent with the NRC Memorandum, upon completion of all corrective method and date of closure for the identified issue(s). If you contest the subject or severity of the Non-Cited-Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, Region III; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Davis-Besse Nuclear Power Station. In accordance with Title 10 of the Code of Federal Regulations (10 CFR) of Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). However, the material enclosed herewith contains Security-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRC's ADAMS. If you choose to provide a response and Security-Related Information is necessary to provide an acceptable -Related Information 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390(b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response.

Sincerely,/RA/ Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket No. 50-346 License No. NPF-3

Enclosure:

Inspection Report 05000346/2016409 cc: M. Bear, State Liaison Officer Ohio Emergency Management Agency