Similar Documents at Cook |
---|
Category:Inspection Plan
MONTHYEARML23310A1152023-11-0606 November 2023 Notification of the NRC Baseline Inspection and Request for Information, Inspection Report 05000316/2024002 ML23242A1832023-08-30030 August 2023 Notification of NRC Baseline Inspection and Request for Information; Inspection Report05000315/2023004 ML23131A3282023-05-11011 May 2023 D.C. Cook Information Request for the Cyber-Security Baseline Inspection, Notification to Perform Inspection 05000315/2023404 and 05000316/2023404 ML23076A0212023-03-20020 March 2023 Request for Information for NRC Commercial Grade Dedication Inspection; Inspection Report 05000315/2023011; 05000316/2023011 ML23066A1882023-03-0707 March 2023 Information Request to Support Upcoming Problem Identification and Resolution (Pi&R) Inspection at Donald C. Cook Nuclear Plant IR 05000315/20220062023-03-0101 March 2023 Annual Assessment Letter for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2022006 and 05000316/2022006) IR 05000315/20220052022-08-24024 August 2022 Updated Inspection Plan for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2022005 and 05000316/2022005) ML22130A1722022-05-11011 May 2022 Information Request to Support the NRC Annual Baseline Emergency Action Level and Emergency Plan Changes Inspection IR 05000315/20210062022-03-0202 March 2022 Annual Assessment Letter for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2021006 and 05000316/2021006) ML21309A3322021-11-0505 November 2021 Notification of Nrc Fire Protection Team Inspection Request for Information IR 05000315/20210052021-09-0101 September 2021 Updated Inspection Plan for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2021005 and 05000316/2021005) ML21146A2862021-05-26026 May 2021 Information Request to Support Upcoming Problem Identification and Resolution Inspection at Donald C. Cook Nuclear Plant ML21068A3512021-03-0909 March 2021 Notification of NRC Baseline Inspection and Request for Information; Inspection Report 05000315/2021002; 05000316/2021002 IR 05000315/20200062021-03-0404 March 2021 Annual Assessment Letter for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2020006 and 05000316/2020006) ML21012A0592021-01-12012 January 2021 Information Request for the Cyber-Seruity Full Implementation Inspection, Notification to Perform Inspection 05000315/2021401; 05000316/2021401 IR 05000315/20200112020-09-17017 September 2020 Information Request to Support Upcoming Temporary Instruction 2515/194 Inspection; Inspection Report 05000315/2020011; 05000316/2020011 IR 05000315/20200052020-09-0101 September 2020 Updated Inspection Plan for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2020005 and 05000316/2020005) ML20133J9722020-05-14014 May 2020 Information Request to Support the NRC Annual Baseline Emergency Action Level and Emergency Plan Changes Inspection IR 05000315/20200202020-04-10010 April 2020 Units 1 and 2 - Information Request for NRC Triennial Evaluation of Changes, Tests, and Experiments (50.59) Baseline Inspection 05000315/2020020 and 05000316/2020020 IR 05000315/20190062020-03-0303 March 2020 Annual Assessment Letter for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2019006 and 05000316/2019006) ML20016A3842020-01-16016 January 2020 Notification of an NRC Biennial Licensed Operator Requalification Program Inspection and Request for Information IR 05000315/20204102019-11-19019 November 2019 Information Request for the Cyber Security Full Implementation Inspection, Notification to Perform Inspection 05000315/2020410; 05000316/2020410 IR 05000315/20190052019-08-28028 August 2019 Updated Inspection Plan for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2019005 and 05000316/2019005) ML19192A1552019-07-11011 July 2019 Ltr. 07/11/19 Donald C. Cook Nuclear Power Plant, Unit 2 - Notification of NRC Baseline Inspection and Request for Information; Inspection Report 05000315/2019004; 05000316/2019004 (DRS-M.Holmberg) ML19128A3482019-05-0808 May 2019 Ltr. 05/08/19 Donald C. Cook Nuclear Power Plant, Units 1 and 2 - Notification of NRC Triennial Fire Protection Baseline Inspection Request for Information; Inspection Report 05000315/2019012; 05000316/2019012 (DRS-A.Shaikh) ML19078A3732019-03-19019 March 2019 Information Request to Support Upcoming Problem Identification and Resolution Inspection at the Donald C. Cook Nuclear Power Plant, Units 1 and 2 IR 05000315/20180062019-03-0404 March 2019 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2018006 and 05000316/2018006) ML19037A3842019-02-0404 February 2019 Ltr. 02/04/19 Donald C. Cook Nuclear Power Plant, Unit 1 - Notification of NRC Baseline Inspection and Request for Information; Inspection Report 05000315/2019001; 05000316/2019001 (DRS-E.Fernandez) IR 05000315/20180052018-08-28028 August 2018 Updated Inspection Plan for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2018005 and 05000316/2018005) IR 05000315/20170062018-03-0202 March 2018 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2017006; 05000316/2017006) ML18058B6192018-02-27027 February 2018 Inspection Plan for Donald C. Cook, Unit 2, for Inservice Inspection Activities; Inspection Report 05000316/2018002 (DRS-L.Smith) IR 05000315/20170052017-08-28028 August 2017 Updated Inspection Plan for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2017005; 05000316/2017005) ML17076A3592017-03-17017 March 2017 Notification of an NRC Triennial Heat Sink Performance Inspection and Request for Information; Inspection Report 05000315/2017002; 05000316/2017002 (Lnr) IR 05000315/20160062017-03-0101 March 2017 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2016006; 05000316/2016006) IR 05000315/20160052016-08-31031 August 2016 Mid-Cycle Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2016005; 05000316/2016005) ML16211A0322016-07-28028 July 2016 Request for Inforamtion for an NRC Post-Approval Site Inspection for License Renewal Inspection Report 05000316/2016010 IR 05000315/20150062016-03-0202 March 2016 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2(Report 05000315/2015006 and 05000316/2015006) ML16013A1832016-01-12012 January 2016 Notification of NRC Inspection and Request for Information (Jen) IR 05000315/20150052015-09-0101 September 2015 Mid-Cycle Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2015005; 05000316/2015005) IR 05000315/20140012015-03-0404 March 2015 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2, (Report 05000315/2014001 and 05000316/2014001) ML14317A5892014-11-13013 November 2014 Notification of NRC Triennial Heat Sink Performance Inspection and Request for Information Inspection 05000315/2015002; 05000316/2015002 ML14245A2562014-09-0202 September 2014 Mid-Cycle Assessment Letter for Donald C. Cook Nuclear Power Plant, Units 1 and 2 IR 05000316/20130012014-03-0404 March 2014 Annual Assessment Letter for Donald C. Cook Nuclear Power Plant, Unit 1 and 2 (Report 05000351/2013001; 05000316/2013001) ML14024A4762014-01-23023 January 2014 Information Request for a NRC Post-Approval Site Inspection for License Renewal 05000315-14-007 ML13246A2272013-09-0303 September 2013 2013 Donald C. Cook Mid-Cycle Letter Combined IR 05000315/20120012013-03-0404 March 2013 Annual Assessment Letter for D.C. Cook Nuclear Power Plant, Units 1 and 2, (Report 05000315/2012001 and 05000316/2012001) ML13032A5182013-02-0101 February 2013 IR 05000315-13-009 & 05000316-13-009, on 05/28-29/2013, 05/29-31/2013, 06/10-14/2013, & 06/24-28/2013, Donald C. Cook, Units 1 & 2- Notification to Perform a Triennial Fire Protection Baseline Inspection While Transition to 10 CFR 50.48(C). ML12248A3012012-09-0404 September 2012 Mid-Cycle Assessment Letter for Donald C. Cook Nuclear Power Plant Units 1 and 2 ML12235A2462012-08-21021 August 2012 IR 05000315-12-005 & 05000316-12-005, 11/26-30/2012, D.C. Cook Nuclear Power Plant, Units 1 & 2 - Notification of an NRC Triennial Heat Sink Performance & Review of Implementation of Industry Initiative to Control Degradation of Underground IR 05000315/20110072012-03-0505 March 2012 Annual Assessment Letter for D.C. Cook Nuclear Power Plant, Units 1 and 2 (Report 05000315/2011007 and 05000316/2011007) 2023-08-30
[Table view] Category:Letter
MONTHYEARIR 05000315/20230042024-01-31031 January 2024 Integrated Inspection Report 05000315/2023004 and 05000316/2023004 ML24004A1582024-01-19019 January 2024 Exemption from Select Requirements of 10 CFR Part 73 (EPID L-2023-LLE-0039 (Security Notifications, Reports, and Recordkeeping and Suspicious Activity Reporting)) AEP-NRC-2024-01, Emergency Plan Revision 482024-01-0808 January 2024 Emergency Plan Revision 48 AEP-NRC-2023-56, Report Per Technical Specification 5.6.6 for Inoperability of Unit 1 Post Accident Monitoring Reactor Coolant (Loop 3 Cold Leg) Wide Range Temperature Recorder Thermal Sensor2023-12-20020 December 2023 Report Per Technical Specification 5.6.6 for Inoperability of Unit 1 Post Accident Monitoring Reactor Coolant (Loop 3 Cold Leg) Wide Range Temperature Recorder Thermal Sensor ML23352A3502023-12-19019 December 2023 Dc. Cook Nuclear Power Plant, Units 1 Biennial Licensed Operator Requalification Program Inspection and Request for Information ML23338A2642023-12-0505 December 2023 Confirmation of Initial License Examination AEP-NRC-2023-45, Unit 2 - Schedular Exemption for Enhanced Weapons, Firearms, Background Checks, and Security Event Notifications Implementation2023-11-16016 November 2023 Unit 2 - Schedular Exemption for Enhanced Weapons, Firearms, Background Checks, and Security Event Notifications Implementation IR 05000315/20234042023-11-0606 November 2023 Cyber Security Inspection Report 05000315/2023404 and 05000316/2023404 ML23310A1152023-11-0606 November 2023 Notification of the NRC Baseline Inspection and Request for Information, Inspection Report 05000316/2024002 IR 05000315/20234032023-09-19019 September 2023 Security Baseline Inspection Report 05000315/2023403 and 05000316/2023403 IR 05000315/20230112023-08-31031 August 2023 Functional Engineering Inspection - Commercial Grade Dedication Report 05000315/2023011 and 05000316/2023011 ML23242A1832023-08-30030 August 2023 Notification of NRC Baseline Inspection and Request for Information; Inspection Report05000315/2023004 AEP-NRC-2023-40, Annual Report of Loss-of-Coolant Accident Evaluation Model Changes2023-08-29029 August 2023 Annual Report of Loss-of-Coolant Accident Evaluation Model Changes IR 05000315/20234022023-08-11011 August 2023 Security Baseline Inspection Report 05000315/2023402 and 05000316/2023402 AEP-NRC-2023-34, Supplement to Request for Approval of Change Regarding Neutron Flux Instrumentation2023-08-0202 August 2023 Supplement to Request for Approval of Change Regarding Neutron Flux Instrumentation IR 05000315/20230022023-07-24024 July 2023 Integrated Inspection Report 05000315/2023002 and 05000316/2023002 ML23178A2422023-06-28028 June 2023 Reassignment of the U.S. Nuclear Regulatory Commission Branch Chief in the Division of Operating Reactor Licensing for Plant Licensing Branch III IR 05000315/20230122023-06-22022 June 2023 Biennial Problem Identification and Resolution Inspection Report 05000315/2023012 and 05000316/2023012 IR 05000315/20235012023-06-21021 June 2023 Emergency Preparedness Biennial Exercise Inspection Report 05000315/2023501 and 05000316/2023501 AEP-NRC-2023-29, Core Operating Limits Report2023-06-19019 June 2023 Core Operating Limits Report ML23159A0192023-06-13013 June 2023 Information Meeting with a Question and Answer Session to Discuss NRC 2022 End-Of-Cycle Plant Performance Assessment of Donald C. Cook Nuclear Plant, Units 1 and 2 AEP-NRC-2023-32, Response to NRC Regulatory Issue Summary 2023-1 Preparation and Scheduling of Operator Licensing Examinations2023-06-0606 June 2023 Response to NRC Regulatory Issue Summary 2023-1 Preparation and Scheduling of Operator Licensing Examinations AEP-NRC-2023-33, Renewable Operating Permit2023-06-0505 June 2023 Renewable Operating Permit AEP-NRC-2023-30, Follow-Up Notification of Ph Non-Compliance for Turbine Room Sump2023-06-0101 June 2023 Follow-Up Notification of Ph Non-Compliance for Turbine Room Sump AEP-NRC-2023-27, Annual Radiological Environmental Operating Report2023-05-15015 May 2023 Annual Radiological Environmental Operating Report ML23131A3282023-05-11011 May 2023 D.C. Cook Information Request for the Cyber-Security Baseline Inspection, Notification to Perform Inspection 05000315/2023404 and 05000316/2023404 IR 05000315/20230012023-05-0303 May 2023 Integrated Inspection Report 05000315/2023001 and 05000316/2023001 AEP-NRC-2023-19, Annual Radioactive Effluent Release Report2023-04-30030 April 2023 Annual Radioactive Effluent Release Report ML23117A0062023-04-27027 April 2023 Review of the Spring 2022 Steam Generator Tube Inspections Report ML23114A1142023-04-25025 April 2023 Information Request to Support the NRC Annual Baseline Emergency Action Level and Emergency Plan Changes Inspection AEP-NRC-2023-23, Annual Report of Individual Monitoring for 20222023-04-24024 April 2023 Annual Report of Individual Monitoring for 2022 AEP-NRC-2023-24, Notification of Ph Non-Compliance for Turbine Room Sump2023-04-12012 April 2023 Notification of Ph Non-Compliance for Turbine Room Sump AEP-NRC-2023-20, Annual Report of Property Insurance2023-04-0303 April 2023 Annual Report of Property Insurance AEP-NRC-2023-15, Decommissioning Funding Status Report2023-03-28028 March 2023 Decommissioning Funding Status Report ML23076A0212023-03-20020 March 2023 Request for Information for NRC Commercial Grade Dedication Inspection; Inspection Report 05000315/2023011; 05000316/2023011 IR 05000315/20234012023-03-16016 March 2023 Security Baseline Inspection Report 05000315/2023401 and 05000316/2023401 ML23066A1882023-03-0707 March 2023 Information Request to Support Upcoming Problem Identification and Resolution (Pi&R) Inspection at Donald C. Cook Nuclear Plant IR 05000315/20220062023-03-0101 March 2023 Annual Assessment Letter for Donald C. Cook Nuclear Plant, Units 1 and 2 (Report 05000315/2022006 and 05000316/2022006) IR 05000315/20220042023-02-0101 February 2023 Integrated Inspection Report 05000315/2022004 and 05000316/2022004 and Exercise of Enforcement Discretion AEP-NRC-2023-11, Form OAR-1, Owner'S Activity Report2023-01-31031 January 2023 Form OAR-1, Owner'S Activity Report IR 05000315/20230102023-01-31031 January 2023 Phase 4 Post-Approval License Renewal Inspection Report 05000315/2023010 and 05000316/2023010 AEP-NRC-2023-02, Request for Approval of Change Regarding Neutron Flux Instrumentation2023-01-26026 January 2023 Request for Approval of Change Regarding Neutron Flux Instrumentation ML22363A5622023-01-0404 January 2023 Relief Request ISIR-5-06 Related to ASME Code Case N-729-6 Supplemental Examination Requirements of Reactor Vessel Closure Head Penetration Nozzles AEP-NRC-2022-66, Report Per Technical Specification 5.6.6 for Inoperability of Unit 2 Post Accident Monitoring Neutron Flux Monitoring2022-12-15015 December 2022 Report Per Technical Specification 5.6.6 for Inoperability of Unit 2 Post Accident Monitoring Neutron Flux Monitoring AEP-NRC-2022-46, Notification of Deviation from Electric Power Research Institute (EPRI) Materials Reliability Program 2019-008, Interim Guidance for NEI 03-08 Needed Requirements for Us PWR Plants for Management of Thermal Fatigue in2022-12-12012 December 2022 Notification of Deviation from Electric Power Research Institute (EPRI) Materials Reliability Program 2019-008, Interim Guidance for NEI 03-08 Needed Requirements for Us PWR Plants for Management of Thermal Fatigue in ML22340A1392022-11-30030 November 2022 Submittal of Revision 31 to Updated Final Safety Analysis Report and 10CFR50.71(e) Updated and Related Site Change Reports IR 05000315/20220112022-11-0404 November 2022 Design Basis Assurance Inspection (Teams) Inspection Report 05000315/2022011 and 05000316/2022011 IR 05000315/20220032022-10-28028 October 2022 Integrated Inspection Report 05000315/2022003 and 05000316/2022003 AEP-NRC-2022-58, U1C31 Steam Generator Tube Inspection Report2022-10-24024 October 2022 U1C31 Steam Generator Tube Inspection Report AEP-NRC-2022-61, Request for Relief Related to American Society of Mechanical Engineers (ASME) Code Case N-729-6 Supplemental Examination Requirements, ISIR-5-062022-10-24024 October 2022 Request for Relief Related to American Society of Mechanical Engineers (ASME) Code Case N-729-6 Supplemental Examination Requirements, ISIR-5-06 2024-01-08
[Table view] |
See also: IR 05000315/2023404
Text
May 11, 2023
Q. Shane Lies
Senior VP and Chief Nuclear Officer
Indiana Michigan Power Company
Nuclear Generation Group
One Cook Place
Bridgman, MI 49106
SUBJECT: DONALD C. COOK NUCLEAR PLANT-INFORMATION REQUEST FOR THE
CYBER-SECURITY BASELINE INSPECTION, NOTIFICATION TO PERFORM
INSPECTION 05000315/2023404 AND 05000316/2023404
Dear Q. Shane Lies:
On September 18, 2023, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline
inspection in accordance with Inspection Procedure (IP) 71130.10 Cyber-Security, Revision 0
at your D. C Cook Nuclear Plant. The inspection will be performed to evaluate and verify your
ability to meet the NRCs Cyber-Security Rule, Title 10, Code of Federal Regulations (10 CFR),
Part 73, Section 54, Protection of Digital Computer and Communication Systems and
Networks. The onsite portion of the inspection will take place September 18-22, 2323.
Experience has shown that baseline inspections are extremely resource intensive, both for the
NRC inspectors and the licensee staff. In order to minimize the inspection impact on the site
and to ensure a productive inspection for both parties, we have enclosed a request for
documents needed for the inspection. These documents have been divided into four groups.
The first group specifies information necessary to assist the inspection team in choosing the
focus areas (i.e., sample set) to be inspected by the cyber-security IP. This information should
be made available electronically no later than July 19, 2023. The inspection team will review this
information and, by August 2, 2023, will request the specific items that should be provided for
review.
The second group of additional requested documents will assist the inspection team in the
evaluation of the critical systems and critical digital assets (CSs/CDAs), defensive architecture,
and the areas of the licensees Cyber Security Plan (CSP) selected for the cyber-security
inspection. This information will be requested for review in the regional office prior to the
inspection by September 1, 2023, as identified above.
The third group of requested documents consists of those items that the inspection team will
review, or need access to, during the inspection. Please have this information available by the
first day of the onsite inspection, September 18, 2023.
Q. Lies 2
The fourth group of information is necessary to aid the inspection team in tracking issues
identified as a result of the inspection. It is requested that this information be provided to the
lead inspector as the information is generated during the inspection. It is important that all of
these documents are up to date and complete in order to minimize the number of additional
documents requested during the preparation and/or the onsite portions of the inspection.
The lead inspector for this inspection is Jasmine Gilliam. We understand that our regulatory
contact for this inspection is Kristen Harper of your organization. If there are any questions
about the inspection or the material requested, please contact the lead inspector at
630-829-9831 or via email at Jasmine.Gilliam@nrc.gov.
This letter does not contain new or amended information collection requirements subject to the
Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection
requirements were approved by the Office of Management and Budget, Control
Number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to
respond to, a request for information or an information collection requirement unless the
requesting document displays a currently valid Office of Management and Budget Control
Number.
In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding,
of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available
electronically for public inspection in the NRCs Public Document Room or from the Publicly
Available Records (PARS) component of the NRC's Agencywide Documents Access and
Management System (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
Signed by Gilliam, Jasmine
on 05/11/23
Jasmine Gilliam, Senior Reactor Inspector
Engineering Branch 2
Division of Operating Reactor Safety
Docket Nos. 05000315 and 05000316
License Nos. DPR-58 and DPR-74
Enclosure:
Cyber-Security Inspection
Document Request
cc w/encl: Distribution via LISTSERV
Q. Lies 3
Letter to Q. Shane Lies from Jasmine Gilliam dated May 11, 2023.
SUBJECT: DONALD C. COOK NUCLEAR PLANT-INFORMATION REQUEST FOR THE
CYBER-SECURITY BASELINE INSPECTION, NOTIFICATION TO PERFORM
INSPECTION 05000315/2023404 AND 05000316/2023404
DISTRIBUTION:
Jessie Quichocho
Paul Zurawski
RidsNrrDorlLpl3
RidsNrrPMDCCook Resource
RidsNrrDroIrib Resource
John Giessner
Mohammed Shuaibi
Diana Betancourt-Roldan
Allan Barker
R3-DORS
ADAMS Accession Number: ML23131A328
Publicly Available Non-Publicly Available Sensitive Non-Sensitive
OFFICE RIII
NAME JGilliam:gmp
DATE 05/11/2023
OFFICIAL RECORD COPY
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
Inspection Report: 05000315/2023404; 05000316/2023404
Inspection Dates: September 18-22, 2023
Inspection Procedure: IP 71130.10, Cyber-Security, Revision 0
NRC Inspectors: Jasmine Gilliam, Lead Kevin Barclay
630-829-9831 630-829-9885
Jasmine.Gilliam@nrc.gov Kevin.Barclay@nrc.gov
NRC Contractors: Tim Marshall Michael Shock
Timothy.Marshall@nrc.gov Michael.Shock@nrc.gov
I. Information Requested for In-Office Preparation
The initial request for information (i.e., first RFI) concentrates on providing the inspection
team with the general information necessary to select appropriate components and
Cyber Security Plan (CSP) elements to develop a site-specific inspection plan. The first
RFI is used to identify the list of critical systems and critical digital assets (CSs/CDAs)
plus operational and management (O&M) security control portions of the CSP to be
chosen as the sample set required to be inspected by the cyber-security Inspection
Procedure (IP). The first RFIs requested information is specified below in Table RFI #1.
The Table RFI #1 information is requested to be provided to the regional office by July
19, 2023, or sooner, to facilitate the selection of the specific items that will be reviewed
during the onsite inspection weeks.
The inspection team will examine the returned documentation from the first RFI and
identify/select specific systems and equipment (e.g., CSs/CDAs) to provide a more
focused follow-up request to develop the second RFI. The inspection team will submit
the specific systems and equipment list to your staff by August 2, 2023, which will
identify the specific systems and equipment that will be utilized to evaluate the
CSs/CDAs, defensive architecture, and the areas of the licensees CSP selected for the
cyber-security inspection. We request that the additional information provided from the
second RFI be made available to the regional office prior to the inspection by
September 1, 2023.
The required Table RFI #1 information shall be provided electronically to the lead
inspector by July 19, 2023. If a compact disk (CD) is provided, please provide four
copies (one for each inspector/contactor). The preferred file format for all lists is a
searchable Excel spreadsheet file. These files should be indexed and hyper-linked to
facilitate ease of use. If you have any questions regarding this information, please call
the inspection team leader as soon as possible.
Enclosure
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
Table RFI #1
Request: IP Ref
A list of all Identified CSs/CDAs-highlight/note any additions,
deletions, reclassifications due to new guidance from white papers,
1 Overall
changes to NEI 10-04, 13-10, etc., since the last cyber-security
inspection
A list of Emergency Preparedness and Security onsite and offsite
2 Overall
digital communication systems
Network Topology Diagrams to include information and data flow for
3 Overall
critical systems in levels 2, 3 and 4 (If available)
4 Ongoing Monitoring and Assessment program documentation 03.01(a)
The most recent effectiveness analysis of the Cyber-Security
5 03.01(b)
Program
6 Vulnerability screening/assessment and scan program documentation 03.01(c)
Cyber-Security Incident response documentation, including incident
detection, response, and recovery documentation as well as 03.02(a)
7 contingency plan development, implementation and including any and
program documentation that requires testing of security boundary 03.04(b)
device functionality
8 Device Access and Key Control documentation 03.02(c)
9 Password/Authenticator documentation 03.02(c)
10 User Account/Credential documentation 03.02(d)
Portable Media and Mobile Device control documentation, including
11 03.02(e)
kiosk security control assessment/documentation
Design change/modification program documentation and a list of all
design changes that affected CDAs that have been installed and
12 completed since the last cyber-security inspection, including either a 03.03(a)
summary of the design change or the 50.59 documentation of the
change
03.03(a)
Supply Chain Management documentation including any security
13 , (b) and
impact analysis for new acquisitions
(c)
2
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
Configuration Management documentation including any security
03.03(a)
14 impact analysis performed due to configuration changes since the last
and (b)
inspection
Cyber-Security Plan and any 50.54(p) analysis to support changes to
15 03.04(a)
the plan since the last inspection
03.06
16 Cyber-Security Metrics tracked (if applicable)
(b)
Provide documentation describing any cyber-security changes to the
17 Overall
access authorization program since the last cyber-security inspection
Provide a list of all procedures and policies provided to the NRC with
18 Overall
their descriptive name and associated number (if available)
03.06
19 Performance testing report (if applicable)
(a)
In addition to the above information please provide the following:
(1) Electronic copy of the Updated Final Safety Analysis Report (UFSAR) and
technical specifications.
(2) Name(s) and phone numbers for the regulatory and technical contacts.
(3) Current management and engineering organizational charts.
Based on this information, the inspection team will identify and select specific systems
and equipment (e.g., CSs/CDAs) from the information requested by Table RFI #1 and
submit a list of specific systems and equipment to your staff by August 2, 2023, for the
second RFI (i.e., RFI #2).
II. Additional Information Requested to be Available Prior to Inspection
As stated in Section I above, the inspection team will examine the returned
documentation requested from Table RFI #1 and submit the list of specific systems and
equipment to your staff by August 2, 2023, for the second RFI (i.e., RFI #2). The second
RFI will request additional information required to evaluate the CSs/CDAs, defensive
architecture, and the areas of the licensees CSP selected for the cyber-security
inspection. The additional information requested for the specific systems and equipment
is identified in Table RFI #2.
The Table RFI #2 information shall be provided electronically to the lead inspector by
September 1, 2023. If a CD is provided, please provide four copies (one for each
inspector/contactor). The preferred file format for all lists is a searchable Excel
spreadsheet file. These files should be indexed and hyper-linked to facilitate ease of
use. If you have any questions regarding this information, please call the inspection
team leader as soon as possible.
3
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
Table RFI #2
Request
Items
For the system(s) chosen for inspection provide:
Ongoing Monitoring and Assessment activity performed on the
1 03.01(a)
system(s)
2 All Security Control Assessments for the selected system(s) 03.01(a)
All vulnerability screenings/assessments associated with or scans
3 performed on the selected system(s) since the last cyber-security 03.01(c)
inspection
Documentation (including configuration files and rules sets) for
Network-based Intrusion Detection/Protection Systems (NIDS/NIPS),
4 Host-based Intrusion Detection Systems (HIDS), and Security 03.02(b)
Information and Event Management (SIEM) systems for system(s)
chosen for inspection)
Documentation (including configuration files and rule sets) for
5 intra-security level firewalls and boundary devices used to protect 03.02(c)
the selected system(s)
Copies of all periodic reviews of the access authorization list for the
6 selected systems since the last inspection 03.02(d)
7 Baseline configuration data sheets for the selected CDAs 03.03(a)
Documentation on any changes, including Security Impact Analyses,
8 performed on the selected system(s) since the last inspection 03.03(b)
Copies of the purchase order documentation for any new equipment
9 purchased for the selected systems since the last inspection 03.03(c)
Copies of any cyber-security drills performed since the last 03.02(a)
10 inspection, along with any reports or assessments generated 03.04(b)
4
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
Copy of the individual recovery plan(s) for the selected system(s)
03.02(a)
11 including documentation of the results the last time the backups 03.04(b)
were executed
Corrective actions taken as a result of cyber-security
12 incidents/issues to include previous NRC violations and Licensee 03.04(d)
Identified Violations since the last cyber-security inspection
III. Information Requested to be Available on First Day of Inspection
For the specific systems and equipment identified in Section II above, provide the
following RFI (i.e., Table 1ST Week Onsite) electronically by September 18, 2023, the
first day of the inspection.
Table 1ST Week Onsite
Request: Items
Any cyber-security event reports submitted in accordance with
1 03.04(a)
10 CFR 73.77 since the last cyber-security inspection
Updated Copies of corrective actions taken as a result of
cyber-security incidents/issues, to include previous NRC violations
2 03.04(d)
and Licensee Identified Violations since the last cyber-security
inspection, as well as vulnerability-related corrective actions
In addition to the above information please provide the following:
(1) Copies of the following documents do not need to be solely available to the
inspection team as long as the inspectors have easy and unrestrained access to
them.
a. UFSAR, if not previously provided;
b. Original Final Safety Analysis Report (FSAR) Volumes;
c. Original Safety Evaluation Report (SER) and Supplements;
d. FSAR Question and Answers;
e. Quality Assurance (QA) Plan;
f. Technical Specifications, if not previously provided; and
g. Latest Individual Plant Examination and Probabilistic Risk Assessment
(IPE/PRA) Report.
5
CYBER-SECURITY INSPECTION DOCUMENT REQUEST
(2) Vendor Manuals, Assessment and Corrective Actions:
a. The most recent Cyber-Security QA audit and/or self-assessment; and
b. Corrective action documents (e.g., condition reports, including status of
corrective actions) generate as a result of the most recent Cyber-Security QA
audit and/or self-assessment.
IV. Information Requested to be Provided Throughout the Inspection
(1) Copies of any corrective action documents generated as a result of the inspection
teams questions or queries during the inspection.
(2) Copies of the list of questions submitted by the inspection team members and the
status/resolution of the information requested (provided daily during the
inspection to each inspection team member).
If you have any questions regarding the information requested, please contact the inspection
team leader.
6