IR 05000498/2017407

Information Request the Cyber Security Baseline Inspection, Notification to Perform Inspection 05000498/2017407; 05000499/2017407

ML17132A071
Person / Time
Site:	South Texas
Issue date:	05/15/2017
From:	Greg Werner Operations Branch IV
To:	Gerry Powell South Texas
Werner G
References
IR 2017407
Download: ML17132A071 (8)

Text

May 15, 2017

SUBJECT:

SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION, UNITS 1 AND 2 - INFORMATION REQUEST THE CYBER SECURITY BASELINE INSPECTION, NOTIFICATION TO PERFORM INSPECTION 05000498/2017407; 05000499/2017407

Dear Mr. Powell:

On July 24, 2017, the U.S. Nuclear Regulatory Commission (NRC) will begin a baseline inspection at the South Texas Project Electric Generating Station. This inspection evaluates and verifies your ability to meet the full implementation requirements of the NRCs Cyber Security Rule, Title 10, Code of Federal Regulations (CFR), Part 73, Section 54, Protection of Digital Computer and Communication Systems and Networks. The onsite portion of the inspection will take place during the weeks of July 24, 2017, and August 7, 2017.

Experience has shown that baseline inspections are extremely resource intensive, both for the NRC inspectors and the licensee staff. In order to minimize the inspection impact on the site and to ensure a productive inspection for both parties, we have enclosed a request for documents needed for the inspection. These documents have been divided into four groups.

The first group specifies information necessary to assist the team in choosing the focus areas (i.e., sample set) to be inspected in accordance with the cyber security inspection procedure. This information should be made available using a compact disc and delivered to the regional office no later than June 5, 2017. The inspection team will review this information and by the end of the planned information gathering visit on June 22, 2017, will request the specific items that should be provided for review.

The second group of requested documents will assist the team in their evaluation of the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for inspection. This information will be requested for review in the regional office prior to the inspection by July 7, 2017, as identified above. The third group of requested documents consists of those items that the team will review or need access to during the inspection. Please have this information available by the first day of the onsite inspection July 24, 2017.

The fourth group of information is necessary to aid the team in tracking issues identified as a result of the inspection. It is requested that this information be provided to the lead inspector as the information is generated during the inspection. It is important that all of these documents are up to date and complete in order to minimize the number of additional documents requested during the preparation and/or the onsite portions of the inspection.

The lead inspector for this inspection is Greg Pick. We understand that our regulatory contact for this inspection is Marilyn Kistler of your organization. If there are any questions about the inspection or the material requested, please contact Greg at 817 200-1270 or by e-mail at greg.pick@nrc.gov.

This letter does not contain new or amended information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing information collection requirements were approved by the Office of Management and Budget, control number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid Office of Management and Budget control number.

In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS)

component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA John Mateychick Acting for/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety

Docket Nos. 50-498 and 50-499 License Nos. NPF-76 and NPF-80

Enclosure:

South Texas Project Electric Generating Station -

Cyber Security Inspection Document Request

cc w/ encl: Electronic Distribution

Enclosure South Texas Project Electric Generating Station -

Cyber Security Inspection Document Request

Inspection Report:

05000498/2017407; 05000499/2017407

Inspection Dates:

Weeks of July 24, 2017, and August 7, 2017

Inspection Procedure:

IP 71130.10, Cyber Security, (In review process at time of request)

Reference 1:

Guidance Document for Development of the Request for Information (RFI) and Notification Letter for Full-Implementation of the Cyber Security Inspection (draft) dated February 2017

NRC Inspectors:

Greg Pick, Lead Samuel Graves 817-200-1270 817-200-1102 greg.pick@nrc.gov samuel.graves@nrc.gov

Shiattin Makor 817-200-1507 shiattin.makor@nrc.gov

NRC Contractors:

Alan Konkal Casey Priester 561-989-0210 301-230-4590 alan.konkal@nrc.gov frederick.priester@nrc.gov

I.

Information Requested for In-Office Preparation

The initial request for information (i.e., first request for information) provides the team with the general information necessary to select appropriate components and cyber security program elements to develop a site-specific inspection plan. The team will use the first set of information requested to identify the list of critical systems and critical digital assets plus operational and management security control portions of the Cyber Security Plan to be chosen as the sample set required to be inspected during this inspection. The first information request is specified in Table RFI #1. Provide the first set of information to the team leader in the regional office by June 5, 2017, or sooner, to facilitate the selection of the specific items that will be reviewed during the onsite inspection weeks.

The team will examine the returned documentation from the first information request and select specific systems and equipment to provide a more focused second request for information. The team will submit the second information request to your staff by the end of the information gathering visit on June 22, 2017, which will identify the specific systems and equipment that will be utilized to evaluate the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for the cyber security inspection. All requests for information shall follow the guidance in Reference 1.

The required Table RFI #1 information shall be provided on compact disc (CD) to the lead inspector by June 5, 2017. Please provide four copies of each CD submitted (i.e., one for each

inspector/contractor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.

Table RFI #1 Section 3, Paragraph Number/Title:

Items

List All Identified Critical Systems and Critical Digital Assets All

List All Facility and Site Ethernet - Transmission Control Protocol/Internet Protocol (TCP/IP)-Based Local Area Networks (LANs)

All

List All Facility and Site Non-Ethernet-TCP/IP-Based LANs All

Network Topology Diagrams All

List All Network Security Boundary Devices All

List All Plant Wired and Wireless Industrial Networks All

Network Intrusion Detection System Documentation 11.a.1)

11.a.2)

Security Information and Event Management Documentation 12.a.1)

12.a.2)

List Onsite and External/Offsite Digital Communications Systems and Devices All

Mobile Device Control 17.a 17.b

Portable Media Control All

Software Management 19.a 19.b.1)

Device Access and Key Control 24.a

Cyber Security Assessment and Cyber Security Incident Response Teams All

In addition to the above information please provide the following:

(1) Electronic copy of the UFSAR and technical specifications (2) Name(s) and phone numbers for the regulatory and technical contacts (3) Current management and engineering organizational charts

Based on this information, the team will identify and select specific systems and equipment (e.g., critical systems and critical digital assets) from the information requested by Table RFI #1 and submit a list of specific systems and equipment to your staff by the end of the information gathering visit on June 22, 2017, for the second information request (i.e., Table RFI #2).

II.

Additional Information Requested to be Available Prior to Inspection

As stated in Section I above, the team will examine the returned documentation requested from the initial information request and submit the list of specific systems and equipment to your staff by the end of the information gathering visit on June 22, 2017, for the second request for information (i.e., Table RFI #2). This second information request obtains additional documents required to evaluate the critical systems and critical digital assets, defensive architecture, and the areas of the cyber security program selected for the cyber security inspection. All requested information shall follow Reference 1.

The Table RFI 2 information shall be provided on CD to the lead inspector by July 7, 2017. Please provide four copies of each CD submitted (i.e., one for each inspector/contractor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.

Table RFI #2 Section 3, Paragraph Number/Title:

Items

Plant Computer System Block Diagram All

Plant Security System Block Diagram All

Systems that are distributed Block Diagrams All

Host-Based Intrusion Detection System Documentation 10.a.1)

10.a.2)

List All Maintenance and Test Equipment Used To Administer CDA Operation, Support, Maintenance, and Service All

Configuration Management All

Supply Chain Management 16.a.

16.b.1)

16.b.5)

16.b.6)

Mobile Device Control 17.c 17.d

Software Management 19.b.2)

19.b.3)

Work Control All

Device Access and Key Control 24.b 24.c

Table RFI #2 Section 3, Paragraph Number/Title:

Items

Password/Authenticator Policy All

User Account/Credential Policy All

III.

Information Requested to be Available on First Day of Inspection

For the specific systems and equipment identified in Section II above, provide the following request for information (i.e., Table 1ST Week Onsite) on CD by July 24, 2017, the first day of the inspection. All requested information shall follow the guidance in Reference 1.

Please provide four copies of each CD submitted (i.e., one for each inspector/contactor). The preferred file format for all lists is a searchable Excel spreadsheet file on a CD. These CDs should be indexed and hyperlinked to facilitate ease of use. If you have any questions regarding this information, please call the inspection team leader as soon as possible.

Table 1ST Week Onsite Section 3, Paragraph Number/Title:

Items 10 Host-Based Intrusion Detection System Documentation 10.a.3)

thru 10.a.12)

11 Network Intrusion Detection System Documentation 11.a.3)

thru 11.a.15)

12 Security Information and Event Management Documentation 12.a.3)

thru 12.a.14)

16 Supply Chain Management 16.b.2)

16.b.3)

16.b.4)

20 Cyber Security Event Notifications All 21 Inventory Management and Control All 22 Vendor Access and Monitoring All

In addition to the above information please provide the following:

(1) Copies of the following documents do not need to be solely available to the inspection team as long as the inspectors have easy and unrestrained access to them.

a. Updated Final Safety Analysis Report, if not previously provided; b. Original FSAR Volumes; c. Original SER and Supplements; d. FSAR Question and Answers; e. Quality Assurance Plan; f.

Technical Specifications, if not previously provided; g. Latest IPE/PRA Report; and

(2) Vendor Manuals, Assessments, and Corrective Actions:

a. The most recent cyber security quality assurance audit and/or self-assessment; and

b. Corrective action documents (e.g., condition reports, including status of corrective actions) generate as a result of the most recent cyber security quality assurance audit and/or self-assessment.

IV.

Information Requested To Be Provided Throughout the Inspection

(1) Copies of any corrective action documents generated as a result of the inspection teams questions or queries during the inspection.

(2) Copies of the list of questions submitted by the inspection team members and the status/resolution of the information requested (provided daily during the inspection to each inspection team member).

If you have any questions regarding the information requested, please contact the team leader.

ML17132A071 SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword: NRC-002 By: GAP Yes No Publicly Available Sensitive

OFFICE SRI:EB2 BC:EB2

NAME G. Pick G. Werner

SIGNATURE

/RA/

/RA/J.

Mateychick for

DATE 05/08/2017 05/15/2017