|
|
| Line 1: |
Line 1: |
| {{Adams | | {{Adams |
| | number = ML17132A071 | | | number = ML17313B151 |
| | issue date = 05/15/2017 | | | issue date = 11/07/2017 |
| | title = South Texas Project Electric Generating Station, Units 1 and 2 - Information Request the Cyber Security Baseline Inspection, Notification to Perform Inspection 05000498/2017407; 05000499/2017407 | | | title = South Texas Project Electric Generating Station NRC Cyber Security Full Implementation Inspection Report 05000498/2017407 and 05000499/2017407 |
| | author name = Werner G E | | | author name = Werner G E |
| | author affiliation = NRC/RGN-IV/DRS/OB | | | author affiliation = NRC/RGN-IV/DRS/EB-2 |
| | addressee name = Powell G T | | | addressee name = Powell G T |
| | addressee affiliation = South Texas Project Nuclear Operating Co | | | addressee affiliation = South Texas Project Nuclear Operating Co |
| | docket = 05000498, 05000499 | | | docket = 05000498, 05000499 |
| | license number = NPF-076, NPF-080 | | | license number = NPF-076, NPF-080 |
| | contact person = Werner G E | | | contact person = Greg Werner |
| | document report number = IR 2017407 | | | document report number = IR 2017407 |
| | document type = Letter, Request for Additional Information (RAI) | | | document type = Inspection Report, Letter |
| | page count = 8 | | | page count = 3 |
| }} | | }} |
|
| |
|
| Line 19: |
Line 19: |
| =Text= | | =Text= |
| {{#Wiki_filter: | | {{#Wiki_filter: |
| [[Issue date::May 15, 2017]] | | [[Issue date::November 7, 2017]] |
|
| |
|
| Mr. G. Executive Vice President and CNO STP Nuclear Operating Company P.O. Box 289 Wadsworth, TX 77483 | | Mr. G. Executive Vice President and Chief Nuclear Officer STP Nuclear Operating Company P.O. Box 289 Wadsworth, TX 77483 |
|
| |
|
| SUBJECT: SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION, UNITS 1 AND 2 - INFORMATION REQUEST THE CYBER SECURITY BASELINE INSPECTION, NOTIFICATION TO PERFORM INSPECTION 05000498/2017407; 05000499/2017407 | | SUBJECT: SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION NRC CYBER SECU RITY FULL IMPLEMENTATION INSPECTION |
| | |
| | REPORT 05000498/2017407 AND 05000499/2017407 |
|
| |
|
| ==Dear Mr. Powell:== | | ==Dear Mr. Powell:== |
| On July 24, 2017, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline inspection at the South Texas Project Electric Generating Station. This inspection evaluates and verifies your ability to meet the full implementation requirements of the NRC's Cyber Security Rule, Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, "Protection of Digital Computer and Communication Systems and Networks." The onsite portion of the inspection will take place during the weeks of July 24, 2017, and August 7, 2017. | | On October 2 3, 2017 , the U.S. Nuclear Regulatory Commission (NRC) completed a Cyber Security inspection at your South Texas Project Electric Generating Station, Units 1 and 2. The inspection evaluated full implementation of your cyber security program, as outlined in your approved cyber security plan and described in Inspection Procedure 71130,10P, "Cyber Security," Revision 0. The enclosed inspection report documents the inspection results, which were discussed on October 2 3, 2017 , with Mr. Aldo Capristo, Execu t i ve Vice President and Chief Administrative Officer, and other members of your staff. |
| | |
| Experience has shown that baseline inspections are extremely resource intensive, both for the NRC inspectors and the licensee staff. In order to minimize the inspection impact on the site and to ensure a productive inspection for both parties, we have enclosed a request for documents needed for the inspection. These documents have been divided into four groups.
| |
| | |
| The first group specifies information necessary to assist the team in choosing the focus areas (i.e., "sample set") to be inspected in accordance with the cyber security inspection procedure. This information should be made available using a compact disc and delivered to the regional office no later than June 5, 2017. The inspection team will review this information and by the end of the planned information gathering visit on June 22, 2017, will request the specific items that should be provided for review.
| |
| | |
| The second group of requested documents will assist the team in their evaluation of the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for inspection. This information will be requested for review in the regional office prior to the inspection by July 7, 2017, as identified above. The third group of requested documents consists of those items that the team will review or need access to during the inspection. Please have this information available by the first day of the onsite inspection July 24, 2017.
| |
|
| |
|
| The fourth group of information is necessary to aid the team in tracking issues identified as a result of the inspection. It is requested that this information be provided to the lead inspector as the information is generated during the inspection. It is important that all of these documents are up to date and complete in order to minimize the number of additional documents requested during the preparation and/or the onsite portions of the inspection. | | The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations |
| | , and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. |
|
| |
|
| The lead inspector for this inspection is Greg Pick. We understand that our regulatory contact for this inspection is Marilyn Kistler of your organization. If there are any questions about the inspection or the material requested, please contact Greg at 817 200-1270 or by e-mail at greg.pick@nrc.gov. This letter does not contain new or amended information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection requirements were approved by the Office of Management and Budget, control number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid Office of Management and Budget control number.
| | NRC inspectors documented three findings of very low significance (Green) in this report. These findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy. These issues were discussed and reviewed during a Security Issues Forum Panel meeting conducted on September 20, 2017. |
|
| |
|
| In accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding," of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC's Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
| | If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the South Texas Project Electric Generating Station. If you disagree with a cross |
| | -cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: |
| | Document Control Desk, Washington, DC 20555 0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the South Texas Project Electric Generating Station. |
|
| |
|
| Sincerely,/RA John Mateychick Acting for/
| | This letter will be made available for public inspection and copying at http://www.nrc.gov/reading |
| | -rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding. |
|
| |
|
| Gregory E. Werner, Chief Engineering Branch 2
| | " The material enclosed herewith, however, contains Security |
| | -Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRC's ADAMS. If you choose to provide a response and Security |
| | -Related Information is necessary to provide an acceptable response, please mark your entire response |
| | , "Security-Related Information |
| | -Withhold from public disclosure under 10 CFR 2.390 |
| | ," in accordance with 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390(b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response. |
|
| |
|
| Division of Reactor Safety Docket Nos. 50-498 and 50-499 License Nos. NPF-76 and NPF-80 | | Sincerely,/RA James Drake Acting for/ Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Dockets: 50 |
| | -498; 50-499 Licenses: NPF |
| | -76; NPF-80 Nonpublic |
|
| |
|
| ===Enclosure:=== | | ===Enclosure:=== |
| South Texas Project Electric Generating Station - Cyber Security Inspection Document Request
| | Inspection Report No. 05000498/2017407; 05000499/2017407 |
| | |
| cc w/ encl: Electronic Distribution Enclosure South Texas Project Electric Generating Station - Cyber Security Inspection Document Request Inspection Report: 05000498/2017407; 05000499/2017407 Inspection Dates: Weeks of July 24, 2017, and August 7, 2017 Inspection Procedure: IP 71130.10, "Cyber Security," (In review process at time of request)
| |
| Reference 1: "Guidance Document for Development of the Request for Information (RFI) and Notification Letter for Full-Implementation of the Cyber Security Inspection" (draft) dated February 2017 NRC Inspectors: Greg Pick, Lead Samuel Graves 817-200-1270 817-200-1102 greg.pick@nrc.gov samuel.graves@nrc.gov
| |
| | |
| Shiattin Makor 817-200-1507 shiattin.makor@nrc.gov
| |
| | |
| NRC Contractors: Alan Konkal Casey Priester 561-989-0210 301-230-4590 alan.konkal@nrc.gov frederick.priester@nrc.gov
| |
| | |
| I. Information Requested for In-Office Preparation
| |
| | |
| The initial request for information (i.e., first request for information) provides the team with the general information necessary to select appropriate components and cyber security program elements to develop a site-specific inspection plan. The team will use the first set of information requested to identify the list of critical systems and critical digital assets plus operational and management security control portions of the Cyber Security Plan to be chosen as the "sample set" required to be inspected during this inspection. The first information request is specified in Table RFI #1. Provide the first set of information to the team leader in the regional office by June 5, 2017, or sooner, to fac ilitate the selection of the specific items that will be reviewed during the onsite inspection weeks.
| |
| | |
| The team will examine the returned documentation from the first information request and select specific systems and equipment to provide a more focused second request for information. The team will submit the second information request to your staff by the end of the information gathering visit on June 22, 2017, which will identify the specific systems and equipment that will be utilized to evaluate the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for the cyber security inspection. All requests for information shall follow the guidance in Reference 1.
| |
| | |
| The required Table RFI #1 information shall be provided on compact disc (CD) to the lead inspector by June 5, 2017. Please provide four copies of each CD submitted (i.e., one for each 2 inspector/contractor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
| |
| | |
| Table RFI #1 Section 3, Paragraph Number/Title: Items 1 List All Identified Critical Systems and Critical Digital Assets All 2 List All Facility and Site Ethernet - Transmission Control Protocol/Internet Protocol (TCP/IP)-Based Local Area Networks (LANs)
| |
| All 3 List All Facility and Site Non-Ethernet-TCP/IP-Based LANs All 4 Network Topology Diagrams All 8 List All Network Security Boundary Devices All 9 List All Plant Wired and Wireless Industrial Networks All 11 Network Intrusion Detection System Documentation 11.a.1)11.a.2) 12 Security Information and Event Management Documentation 12.a.1)12.a.2) 14 List Onsite and External/Offsite Digital Communications Systems and Devices All 17 Mobile Device Control 17.a 17.b 18 Portable Media Control All 19 Software Management 19.a 19.b.1) 24 Device Access and Key Control 24.a 27 Cyber Security Assessment and Cyber Security Incident Response Teams All In addition to the above information please provide the following:
| |
| | |
| (1) Electronic copy of the UFSAR and technical specifications (2) Name(s) and phone numbers for the regulatory and technical contacts (3) Current management and engineering organizational charts
| |
| | |
| Based on this information, the team will identify and select specific systems and equipment (e.g., critical systems and critical digital assets) from the information requested by Table RFI #1 and submit a list of specific systems and equipment to your staff by the end of the information gathering visit on June 22, 2017, for the seco nd information request (i.e., Table RFI #2).
| |
| | |
| 3 II. Additional Information Requested to be Available Prior to Inspection As stated in Section I above, the team will examine the returned documentation requested from the initial information request and submit the lis t of specific systems and equipment to your staff by the end of the information gathering visit on June 22, 2017, for the second request for information (i.e., Table RFI #2). This second information request obtains additional documents required to evaluate the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for the cyber security inspection. All requested information shall follow Reference 1.
| |
| | |
| The Table RFI 2 information shall be provided on CD to the lead inspector by July 7, 2017. Please provide four copies of each CD submitted (i.e., one for each inspector/contractor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
| |
| | |
| Table RFI #2 Section 3, Paragraph Number/Title: Items 5 Plant Computer System Block Diagram All 6 Plant Security System Block Diagram All 7 Systems that are distributed Block Diagrams All 10 Host-Based Intrusion Dete ction System Documentation 10.a.1) 10.a.2) 13 List All Maintenance and Test Equipment Used To Administer CDA Operation, Support, Maintenance, and Service All 15 Configuration Management All 16 Supply Chain Management 16.a. 16.b.1) 16.b.5) 16.b.6) 17 Mobile Device Control 17.c 17.d 19 Software Management 19.b.2) 19.b.3) 23 Work Control All 24 Device Access and Key Control 24.b 24.c 4 Table RFI #2 Section 3, Paragraph Number/Title: Items 25 Password/Authenticator Policy All 26 User Account/Credential Policy All III. Information Requested to be Available on First Day of Inspection For the specific systems and equipment identified in Section II above, provide the following request for information (i.e., Table 1 ST Week Onsite) on CD by July 24, 2017, the first day of the inspection. All requested information shall follow the guidance in Reference 1.
| |
| | |
| Please provide four copies of each CD submitted (i.e., one for each inspector/contactor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.
| |
| | |
| Table 1 ST Week Onsite Section 3, Paragraph Number/Title: Items 10 Host-Based Intrusion Dete ction System Documentation 10.a.3) thru 10.a.12) 11 Network Intrusion Detection System Documentation 11.a.3) thru 11.a.15) 12 Security Information and Event Management Documentation 12.a.3) thru 12.a.14) 16 Supply Chain Management 16.b.2) 16.b.3)
| |
| 16.b.4) 20 Cyber Security Event Notifications All 21 Inventory Management and Control All 22 Vendor Access and Monitoring All
| |
| | |
| 5 In addition to the above information please provide the following:
| |
| (1) Copies of the following documents do not need to be solely available to the inspection team as long as the inspectors have easy and unrestrained access to them.
| |
| | |
| a. Updated Final Safety Analysis Report, if not previously provided; b. Original FSAR Volumes; c. Original SER and Supplements; d. FSAR Question and Answers; e. Quality Assurance Plan; f. Technical Specifications, if not previously provided; g. Latest IPE/PRA Report; and (2) Vendor Manuals, Assessments, and Corrective Actions:
| |
| a. The most recent cyber security quality assurance audit and/or self-assessment; and
| |
| | |
| b. Corrective action documents (e.g., condition reports, including status of corrective actions) generate as a result of the most recent cyber security quality assurance audit and/or self-assessment.
| |
| | |
| IV. Information Requested To Be Provided Throughout the Inspection (1) Copies of any corrective action documents generated as a result of the inspection team's questions or queries during the inspection.
| |
| | |
| (2) Copies of the list of questions submitted by the inspection team members and the status/resolution of the information requested (provided daily during the inspection to each inspection team member).
| |
|
| |
|
| If you have any questions regarding the information requested, please contact the team leader.
| | ===w/Attachment:=== |
| | Supplemental Information |
|
| |
|
| ML17132A071 SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword: NRC-002 By: GAP Yes No Publicly Available Sensitive OFFICE SRI:EB2 BC:EB2 NAME G. Pick G. Werner SIGNATURE /RA/ /RA/J.
| | cc w/o enclosure: |
| | Electronic Distribution |
|
| |
|
| Mateychick for DATE 05/08/2017 05/15/2017
| | Entire Report: |
| | ADAMS: Non-Publicly Available Non-Sensitive Keyword: SUNSI Review By: |
| | GAP Yes No Publicly Available Sensitive _______MD 3.4 A.3 ADAMS ACCESSION NUMBER: |
| | ML Cover Letter Only: |
| | ADAMS: Non-Publicly Available Non-Sensitive Keyword: SUNSI Review By: |
| | GAP Yes No Publicly Available Sensitive NRC-002 OFFICE SRI:EB2 RI:EB2 C:EB2 C:PB B C:EB2 NAME GPick SMakor GWerner NTaylor GWerner SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA JFD for/ DATE 10/20/2017 10/24/2017 10/27/2017 11/05/2017 11/07/2017 |
| }} | | }} |
Text
November 7, 2017
Mr. G. Executive Vice President and Chief Nuclear Officer STP Nuclear Operating Company P.O. Box 289 Wadsworth, TX 77483
SUBJECT: SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION NRC CYBER SECU RITY FULL IMPLEMENTATION INSPECTION
REPORT 05000498/2017407 AND 05000499/2017407
Dear Mr. Powell:
On October 2 3, 2017 , the U.S. Nuclear Regulatory Commission (NRC) completed a Cyber Security inspection at your South Texas Project Electric Generating Station, Units 1 and 2. The inspection evaluated full implementation of your cyber security program, as outlined in your approved cyber security plan and described in Inspection Procedure 71130,10P, "Cyber Security," Revision 0. The enclosed inspection report documents the inspection results, which were discussed on October 2 3, 2017 , with Mr. Aldo Capristo, Execu t i ve Vice President and Chief Administrative Officer, and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations
, and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.
NRC inspectors documented three findings of very low significance (Green) in this report. These findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy. These issues were discussed and reviewed during a Security Issues Forum Panel meeting conducted on September 20, 2017.
If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the South Texas Project Electric Generating Station. If you disagree with a cross
-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN:
Document Control Desk, Washington, DC 20555 0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the South Texas Project Electric Generating Station.
This letter will be made available for public inspection and copying at http://www.nrc.gov/reading
-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding.
" The material enclosed herewith, however, contains Security
-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in the enclosure will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRC's ADAMS. If you choose to provide a response and Security
-Related Information is necessary to provide an acceptable response, please mark your entire response
, "Security-Related Information
-Withhold from public disclosure under 10 CFR 2.390
," in accordance with 10 CFR 2.390(d)(1) and follow the instructions for withholding in 10 CFR 2.390(b)(1). In accordance with 10 CFR 2.390(b)(1)(ii), the NRC is waiving the affidavit requirements for your response.
Sincerely,/RA James Drake Acting for/ Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Dockets: 50
-498; 50-499 Licenses: NPF
-76; NPF-80 Nonpublic
Enclosure:
Inspection Report No. 05000498/2017407; 05000499/2017407
w/Attachment:
Supplemental Information
cc w/o enclosure:
Electronic Distribution
Entire Report:
ADAMS: Non-Publicly Available Non-Sensitive Keyword: SUNSI Review By:
GAP Yes No Publicly Available Sensitive _______MD 3.4 A.3 ADAMS ACCESSION NUMBER:
ML Cover Letter Only:
ADAMS: Non-Publicly Available Non-Sensitive Keyword: SUNSI Review By:
GAP Yes No Publicly Available Sensitive NRC-002 OFFICE SRI:EB2 RI:EB2 C:EB2 C:PB B C:EB2 NAME GPick SMakor GWerner NTaylor GWerner SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA JFD for/ DATE 10/20/2017 10/24/2017 10/27/2017 11/05/2017 11/07/2017
