[Federal Register Volume 86, Number 151 (Tuesday, August 10, 2021)]
[Proposed Rules]
[Pages 43599-43609]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-16889]
========================================================================
Proposed Rules
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains notices to the public of
the proposed issuance of rules and regulations. The purpose of these
notices is to give interested persons an opportunity to participate in
the rule making prior to the adoption of the final rules.
========================================================================
Federal Register / Vol. 86, No. 151 / Tuesday, August 10, 2021 /
Proposed Rules
[[Page 43599]]
NUCLEAR REGULATORY COMMISSION
10 CFR Part 73
[Docket No. PRM-73-18; NRC-2014-0165]
Protection of Digital Computer and Communication Systems and
Networks
AGENCY: Nuclear Regulatory Commission.
ACTION: Petition for rulemaking; denial.
-----------------------------------------------------------------------
SUMMARY: The U.S. Nuclear Regulatory Commission (NRC) is denying a
petition for rulemaking (PRM), dated June 12, 2014, submitted by
Anthony Pietrangelo on behalf of the Nuclear Energy Institute. The
petitioner requested that the NRC amend its power reactor cyber
security regulations to make them consistent with the original intent
of the rule and clarify that the scope of those regulations only
require the protection of those digital assets that can directly cause
core damage and spent fuel sabotage, or whose failure would cause a
reactor scram. The petition was docketed by the NRC on September 22,
2014, and assigned Docket No. PRM-73-18. The NRC staff has determined
that the information presented in PRM-73-18 does not support
rulemaking. The NRC has also determined that existing and ongoing
revisions to guidance can effectively address the issues raised by the
petitioner in this PRM. Therefore, for the reasons discussed in the
SUPPLEMENTARY INFORMATION of this document, the NRC is denying PRM-73-
18.
DATES: The docket for the petition for rulemaking, PRM-73-18, is closed
on August 10, 2021.
ADDRESSES: Please refer to Docket ID NRC-2014-0165 when contacting the
NRC about the availability of information for this action. You may
obtain publicly-available information related to this action by any of
the following methods:
Federal Rulemaking website: Go to https://www.regulations.gov and search for Docket ID NRC-2014-0165. Address
questions about NRC dockets to Dawn Forder; telephone: 301-415-3407;
email: [email protected]. For technical questions, contact the
individuals listed in the FOR FURTHER INFORMATION CONTACT section of
this document.
NRC's Agencywide Documents Access and Management System
(ADAMS): You may obtain publicly-available documents online in the
ADAMS Public Documents collection at https://www.nrc.gov/reading-rm/adams.html. To begin the search, select ``Begin Web-based ADAMS
Search.'' For problems with ADAMS, please contact the NRC's Public
Document Room (PDR) reference staff at 1-800-397-4209, 301-415-4737, or
by email to [email protected]. For the convenience of the reader,
the ADAMS accession numbers and instructions about obtaining materials
referenced in this document are provided in the ``Availability of
Documents'' section of this document. The incoming petition is
available in ADAMS under Accession No. ML14184B120.
Attention: The PDR, where you may examine and order copies
of public documents, is currently closed. You may submit your request
to the PDR via email at [email protected] or call 1-800-397-4209
between 8:00 a.m. and 4:00 p.m. (EST), Monday through Friday, except
Federal holidays.
FOR FURTHER INFORMATION CONTACT: Juan Lopez, Office of Nuclear Material
Safety and Safeguards; telephone: 301-415-2338; email:
[email protected]; or Ilka Berrios, Office of Nuclear Material Safety
and Safeguards; telephone: 301-415-2404; email: [email protected].
Both are staff of the U.S. Nuclear Regulatory Commission, Washington,
DC 20555-0001.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. The Petition
II. Background
III. Reasons for Denial
IV. Public Comments on the Petition
V. Availability of Documents
VI. Conclusion
I. The Petition
Section 2.802 of title 10 of the Code of Federal Regulations (10
CFR), ``Petition for rulemaking--requirements for filing,'' provides an
opportunity for any person to petition the Commission to issue, amend,
or rescind any regulation. On June 12, 2014, the NRC received a PRM
from Anthony Pietrangelo on behalf of the Nuclear Energy Institute (NEI
or the petitioner). The petitioner requested that the NRC amend its
regulations in Sec. 73.54, ``Protection of digital computer and
communication systems and networks,'' to clarify the scope of Sec.
73.54(a) to only protect those systems and networks associated with
structures, systems, or components (SSCs) that are either necessary to
prevent core damage and spent fuel sabotage, or whose failure would
cause a reactor scram.
The NRC identified two principal issues in the petition. First, the
petitioner asserts that a rulemaking is needed to clarify the language
in Sec. 73.54(a) to make it consistent with the original intent of
this provision to protect against radiological sabotage by only
protecting those digital assets that if compromised could directly
cause significant core damage or spent fuel sabotage, or whose failure
would cause a reactor scram. Second, the petitioner asserts that what
it sees as the broad scoping language in Sec. 73.54(a)(1) goes
considerably beyond the scope of systems and networks necessary to
prevent radiological sabotage, unnecessarily diverting licensee
attention from the protection of those digital assets having a direct
relationship to radiological sabotage. According to the petitioner, the
time, resources, and costs of protecting from a cyber attack those
digital assets not directly related to preventing radiological sabotage
are inconsistent with the intent of the cyber security rule and are not
justified. As discussed in the ``Reasons for Denial'' section of this
document, the petitioner presented several assertions to support its
petition that the NRC considered in the evaluation the PRM. On
September 22, 2014, the NRC published a notice of docketing of PRM-73-
18 in the Federal Register along with a request for public comment.
II. Background
Following the terrorist attacks of September 11, 2001, the NRC
conducted a review of its security requirements to ensure that nuclear
power reactors and other licensed facilities could effectively protect
against the changing threat environment. Based on this review, the
[[Page 43600]]
NRC issued a series of security orders imposing new security
requirements on nuclear power reactors and other facilities. In NRC
Order EA-02-026, ``Interim Safeguards and Security Compensatory
Measures for Nuclear Power Plants,'' dated February 25, 2002, the NRC
required licensees to address certain cyber security threats at their
facilities to protect against a cyber attack. A subsequent order, NRC
Order EA-03-086, ``Issuance of Order Requiring Compliance with Revised
Design Basis Threat for Operating Power Reactors,'' dated April 29,
2003, required licensees to address additional cyber attack
characteristics.
In 2006, the NRC published in the Federal Register a proposed
rulemaking, ``Power Reactor Security Requirements'' (71 FR 62664;
October 26, 2006), to amend its existing security requirements and add
new security requirements applicable to nuclear power reactors. This
proposed rule contained a new Sec. 73.55(m), ``Digital computer and
communication networks.'' Section 73.55(m)(1) would have required
nuclear power reactor licensees to protect computer systems that, if
compromised, would adversely impact safety, security and emergency
preparedness (SSEP). Section 73.55(m)(2) would have required licensees
to systematically assess and manage cyber risks at their facilities.
The NRC received comments on the proposed rule, including comments on
Sec. 73.55(m).
After considering all comments, the NRC issued a final rule,
``Power Reactor Security Requirements,'' (74 FR 13926; March 27, 2009).
This final rule relocated the cyber security requirements in the
proposed rule's Sec. 73.55(m) to a new stand-alone Sec. 73.54 in the
final rule. As noted by the Commission in the 2009 final rule Statement
of Considerations (SOC), relocating the cyber security requirements
into their own stand-alone section was appropriate because the
implementation of a cyber security program requires a uniquely
independent technical expertise and knowledge that would not
necessarily be implemented by security personnel. As further noted,
placing the cyber security requirements in a stand-alone section would
enable these requirements to be made applicable to other types of
facilities in the future, if warranted.
In 2013, the NRC began performing inspections of NRC licensees' 10
CFR 73.54 cyber security programs. By 2016, the NRC had completed
initial inspections of all NRC licensees' cyber security programs.
During this period of time, both industry and the NRC gained valuable
insights and lessons learned from implementation of the NRC's cyber
security requirements.
In January 2019, the Office of Nuclear Security and Incident
Response's (NSIR) Cyber Security Branch initiated an assessment of the
NRC's cyber security regulations and Power Reactor Cyber Security
Program. Its purpose was to identify key areas of improvement that
would strengthen the NRC's Power Reactor Cyber Security Program. The
cyber assessment team engaged with external stakeholders to gain
additional insights. The Cyber Security Branch in NSIR completed its
assessment of the NRC's Power Reactor Cyber Security Program in July
2019. The assessment identified several enhancements to the Power
Reactor Cyber Security Program, and the NRC staff developed an action
plan to facilitate and prioritize implementation of these enhancements.
The enhancements are intended to further risk-inform the NRC's Power
Reactor Cyber Security Program. Based on the assessment results, the
NRC determined that there was a need to further revise guidance
documents beyond updates already implemented by industry stakeholders
to, among other things, address issues associated with the scoping of
critical digital assets (CDAs).
III. Reasons for Denial
The NRC is denying the petition because the petitioner did not
present sufficient new information to warrant the requested changes to
the NRC's regulations in Sec. 73.54. Specifically, the petitioner did
not show that the regulatory language in Sec. 73.54(a) is inconsistent
with the original intent of this provision or the cyber security rule
and did not show that the regulatory language in Sec. 73.54(a)(1) is
overly broad. Furthermore, an assessment of the NRC's cyber security
regulations and Power Reactor Cyber Security Program performed by NRC
staff as a separate effort from the review of this petition determined
that existing and ongoing revisions to guidance can effectively address
the issues raised by the petitioner in this PRM without the need for
rulemaking.
Assertions in the Petition
The assertions made by the petitioner in Section III of PRM-73-18,
``Bases for the Action Requested by Petitioner,'' are summarized in the
following paragraphs along with the NRC's responses to those
assertions.
Assertion A in Section III of the PRM:
In support of its PRM, the petitioner asserts, in part, that the
scoping language in Sec. 73.54(a) was not included in the 2006
proposed rule and was added to the 2009 final rule without the
opportunity for public notice and comment. The petitioner further
asserts that the effects of this scoping language were likely not clear
when the final rule was issued.
NRC Response to Assertion A:
The NRC disagrees with the petitioner's Assertion A. The 2006
proposed rule contained a new Sec. 73.55(m) titled ``Digital computer
and communication networks.'' Section 73.55(m)(1) would have required
licensees to have a cyber security program that would protect computer
systems that, if compromised, would adversely impact SSEP. The NRC
received several comments on the cyber security requirements in the
2006 proposed rule. This included a comment that the term ``protected
computer system'' used in Sec. 73.55(m)(1)(iii) lacked clarity and
should be better defined in the final rule. As the Commission stated in
the SOC to the 2009 final rule, in response to a public comment, the
NRC revised the language in Sec. 73.55(m)(1), renumbered as Sec.
73.54(a) in the 2009 final rule, to provide a more detailed list of the
types of computer systems and networks requiring protection from a
cyber attack consistent with the language in the proposed rule.
The language in Sec. 73.55(m)(1) of the 2006 proposed rule put
licensees on notice that they were required to protect computer systems
that, if compromised, could adversely affect SSEP. The language in
Sec. 73.54(a) of the 2009 final rule, while modifying the 2006
language from ``SSEP'' to ``SSEP functions'' to better identify the
computer systems and networks requiring protection, did not
significantly change any cyber security requirements from the proposed
rule to the final rule. The 2009 language is consistent with, and a
logical outgrowth of, the language in the 2006 proposed rule.
Accordingly, the NRC was not required to submit this clarifying
language for public notice and comment.
Assertion B in Section III of the PRM:
The petitioner asserts that one result of the Sec. 73.54(a)(1)
language in the 2009 final rule was to enlarge the scope of digital
assets to be protected from cyber attack beyond what the Commission
originally intended in the 2006 proposed rule. The petitioner further
asserts that the Sec. 73.54(a)(1) language requires licensees to
implement cyber security controls on hundreds to thousands of digital
assets, most of which do not, even if compromised, have a direct
relationship to radiological
[[Page 43601]]
sabotage. According to the petitioner, this creates an inconsistency
between the NRC's cyber security requirements and the Sec. 73.55
physical protection program. The petitioner, citing Sec. 73.55(b)(3)
and referencing the existing process used to identify target sets,
asserts that the performance objectives of the Sec. 73.55 physical
protection program must protect against significant core damage and
spent fuel sabotage. However, according to the petitioner, because the
current language in Sec. 73.54(a)(1) requires the protection of
digital assets that cannot, even if compromised, result in significant
core damage or spent fuel sabotage, it is inconsistent with the
performance objectives of the Sec. 73.55 physical protection program.
NRC Response to Assertion B:
The NRC disagrees with the petitioner's Assertion B. The petitioner
asserts that the language in Sec. 73.54(a)(1) is inconsistent with the
cyber security rule's original intent of protecting against the Design
Basis Threat (DBT) of radiological sabotage. The petitioner's assertion
is predicated on the assumption that protecting against the DBT of
radiological sabotage is limited to only protecting that equipment and
those digital assets that can directly cause significant core damage or
spent fuel sabotage.
The NRC agrees that, consistent with the regulatory language in
Sec. 73.54(b)(3) and Sec. 73.55(b)(3), a licensee's cyber security
program must protect against significant core damage and spent fuel
sabotage. However, the NRC does not agree that protecting against the
radiological sabotage DBT only involves protecting those digital assets
that can directly cause significant core damage and spent fuel
sabotage. Rather, protecting against radiological sabotage also
involves protecting those digital assets that could either directly or
indirectly cause significant core damage or spent fuel sabotage.
Additionally, the NRC included EP systems in the cyber security rule
because such systems are essential to mitigate the consequences of
radiological sabotage. Accordingly, for the reasons described in this
section, the NRC does not agree that the language in Sec. 73.54(a)(1)
is inconsistent with either the cyber security rule's original intent
of protecting against the DBT of radiological sabotage or inconsistent
with the performance objectives of Sec. 73.55.
There is nothing in the language of either the 2006 proposed rule
or the 2009 final rule that supports the petitioner's assertion.
Section 73.54(a) of the 2009 final rule states the general performance
objective that licensees must protect against the DBT as described in
Sec. 73.1. There is no language indicating that protecting against the
DBT is limited to protecting only those digital assets that can
directly cause significant core damage or spent fuel sabotage.
Similarly, Regulatory Guide (RG) 5.71, ``Cyber Security Program for
Nuclear Facilities,'' and the other documents cited by the petitioner
reiterate the general performance objective that licensees must protect
against the DBT and prevent significant core damage or spent fuel
damage.
The petitioner references the existing process used to identify
target sets to support the assertion that the performance objectives of
the Sec. 73.55 physical protection program only require protection
against significant core damage and spent fuel sabotage. As noted
previously, the NRC agrees that a licensee's cyber security program
must protect against significant core damage and spent fuel sabotage.
The NRC further agrees that the process for developing and identifying
target sets defines the set of equipment that must be protected from a
physical attack to prevent significant core damage and spent fuel
sabotage. The NRC notes that Sec. 73.55(f)(2) requires that licensees
consider cyber attacks in the development and identification of target
sets. However, the purpose of the cyber security language in Sec.
73.55(f)(2) is to identify a specific type of threat that target sets
must be protected from. This language is not intended and should not be
used to define the scope of the NRC's cyber security requirements.
As previously noted in the NRC's response to petitioner's Assertion
A, Sec. 73.55(m)(1) of the 2006 proposed rule would have required
licensees to have a cyber security program that would protect computer
systems that, if compromised, would adversely impact SSEP. In the SOC
to the 2006 proposed rule, the NRC explained that the cyber security
requirements were designed to minimize potential attack pathways and
the consequences of a successful cyber attack. These requirements are
part of a defense-in-depth strategy to protect SSEP digital assets
that, if compromised, could directly or indirectly result in
radiological sabotage at an NRC-licensed nuclear power plant.
Additionally, the NRC included EP systems in the cyber security rule
because such systems are essential to mitigate the consequences of
radiological sabotage.
The NRC made a conscious and deliberate decision to include
computer and network systems that could affect SSEP functions in the
cyber security rule, even though not all of the equipment and digital
assets requiring protection that are associated with those systems can
directly cause significant core damage or spent fuel sabotage. The NRC
further explained that as computer technology is increasingly
integrated into nuclear power plants, many plant safety and security
systems rely on this technology to carry out their functions. The NRC
intended that digital assets associated with such systems be protected
to minimize potential attack pathways that could indirectly or directly
result in radiological sabotage. Accordingly, the NRC does not agree
with the petitioner's assertion that the original intent of the cyber
security requirements in the 2006 proposed rule was limited to
protecting only those digital assets that could directly cause
significant core damage or spent fuel sabotage. For these reasons, the
NRC has determined that the language in Sec. 73.54(a)(1) is consistent
with the original intent of the 2006 proposed rule and is consistent
with the performance objectives in Sec. 73.55.
Assertion C in Section III of the PRM:
The petitioner asserts that the language in Sec. 73.54(a)(1)
unnecessarily requires licensees to focus on protecting hundreds to
thousands of digital assets at their sites that are, in some way,
associated with the SSEP functions identified in Sec. 73.54(a)(1). The
petitioner asserts that many of these digital assets have no nexus to
radiological sabotage. As a result, the considerable time, resources
and costs needed to protect these assets is not justified. The
petitioner further asserts that granting the petition will lead to a
more efficient use of licensee resources without compromising plant
safety or security.
NRC Response to Assertion C:
The NRC disagrees with the petitioner's assertion that the NRC's
cyber security requirements in Sec. 73.54(a)(1) require the protection
of hundreds, and in some cases thousands, of digital assets that have
no nexus to radiological sabotage. Section 73.54(a)(1) requires that
licensees protect digital computer and communication systems and
networks associated with SSEP functions from a cyber attack. The NRC
recognizes that these systems may contain hundreds and possibly
thousands of digital assets. It is not the NRC's expectation that all
digital assets associated with such functions will necessarily require
protection in accordance with the NRC's cyber security requirements.
Consistent with the requirements in Sec. 73.54(a)(2), only those
digital assets that could adversely impact SSEP functions are within
the scope of the NRC's cyber
[[Page 43602]]
security requirements and must be protected against a cyber attack.
Section 73.54(b)(1) requires licensees to conduct an analysis of
digital computer and communication systems and networks and identify
those digital assets that must be protected against a cyber attack.
This requirement reflects the NRC's recognition that licensees are well
situated to determine the safety and security significance of digital
systems and assets at their facilities. The NRC issued RG 5.71 to
provide guidance to licensees in implementing the NRC's cyber security
requirements. Section 3.1.3 of RG 5.71 recognizes that not all digital
assets associated with SSEP functions may need to be protected. It sets
forth a process for identifying those assets, referred to as CDAs in
the regulatory guide, that must be protected against a cyber attack.
CDAs are those digital assets that meet the criteria in Sec.
73.54(a)(2) and, if compromised, could adversely impact SSEP functions.
The petitioner identifies examples of digital assets--specifically
fax machines, hand-held calibration devices, radios and pagers, and
certain calculators used by licensee staff--that it claims have no
nexus to radiological sabotage. The NRC agrees that some digital assets
associated with SSEP functions may not need to be protected from cyber
attack. Consistent with Sec. 73.54(b)(1), determining whether a
specific digital asset, such as a fax machine, calibration device,
radio, or the like, has a nexus to radiological sabotage requires a
site-specific analysis to determine the safety and security
significance of the specific asset. The purpose of the analysis is to
determine if a specific digital asset must be protected consistent with
the criteria in Sec. 73.54(a)(2). That is why neither the NRC's cyber
security rule nor RG 5.71 prescribe a list of specific digital assets
that must be protected against a cyber attack.
As elaborated in the NRC Response to Assertion B, the NRC does not
agree with the petitioner's assertion that only those digital assets
that, if compromised, can directly result in radiological sabotage are
subject to the NRC's cyber security requirements. Digital assets, the
compromise of which may not directly cause significant core damage or
spent fuel sabotage, but that could serve as attack pathways that
potentially increase the risk of a successful cyber attack if not
protected, are within the scope of the NRC's cyber security
requirements.
The NRC has been conducting cyber security inspections since 2013
and recently completed a major assessment of the NRC's cyber security
requirements. One of the major lessons learned from these inspections
and the assessment is that many licensees adopted a conservative
approach to identifying digital assets at their facilities that could
potentially impact SSEP functions. This resulted in a large number of
digital assets being included within the scope of licensees' cyber
security programs. As a result of the lessons learned from these
inspections and the assessment, the NRC has been and is continuing to
engage with stakeholders to revise existing guidance and refine the
methodology for identifying CDAs that fall within the scope of the
NRC's cyber security requirements. Based on these interactions, NEI
revised NEI 13-10 to include a consequence-based, graded approach for
identifying CDAs. The NEI 13-10 guidance enables industry to focus
resources on the more significant digital assets. The NRC is continuing
to work with stakeholders to identify additional revisions to the
guidance for identifying those digital assets that must be protected
from a cyber attack. For the reasons discussed in this section, the NRC
does not agree with the petitioner's assertion that the language in
Sec. 73.54(a)(1) requires the protection of digital assets that do not
have a nexus to radiological sabotage.
The NRC disagrees with the assertion that the cyber security rule
requires the unnecessary expenditure of licensee resources to protect
digital assets that have no nexus to radiological sabotage. The NRC
issued RG 5.71 in January 2010 to provide guidance to licensees in
implementing the NRC's cyber security requirements. It establishes a
process for identifying those digital assets, called CDAs, that must be
protected against a cyber attack. Some stakeholders have taken a
conservative approach to identifying CDAs. The NRC has determined that
this is an implementation issue, not an issue with the cyber security
rule language. Accordingly, the NRC has been and is continuing to work
with industry stakeholders to revise existing guidance and establish
new guidance to refine the methodology for identifying CDAs. For these
reasons, the NRC does not agree with the petitioner's assertion that
the language in Sec. 73.54(a)(1) requires the protection of digital
assets that do not have a nexus to radiological sabotage and results in
an unjustified burden and costs for licensees.
Assertion D in Section III of the PRM
The petitioner notes that on October 21, 2010, the Commission made
a policy determination to apply the NRC's cyber security rule to SSCs
in the balance of plant (BOP) at NRC-licensed nuclear power plants. The
petitioner further notes that as a result of this policy determination,
SSCs in the BOP were no longer subject to the Federal Energy Regulatory
Commission's (FERC) Critical Infrastructure Protection reliability
standards. The petitioner states that this policy determination
expanded the scope of the cyber security program to include digital
assets not strictly necessary to prevent radiological sabotage.
NRC Response to Assertion D:
The NRC agrees with the petitioner that on October 21, 2010, the
Commission made a policy determination to apply the NRC's cyber
security regulations to SSCs in a nuclear power plant's BOP that have a
nexus to radiological health and safety. The petitioner asserts that
this policy determination expanded the scope of Sec. 73.54(a) to
include digital assets not strictly necessary to be protected to
prevent radiological sabotage.
As the petitioner notes, the Commission's October 2010 policy
determination applied the NRC's cyber security regulations to BOP
digital assets that by themselves, even if compromised, could not
directly cause significant core damage or spent fuel sabotage. For the
same reasons set forth in the NRC's response to the petitioner's
Assertions B and C, the NRC does not agree with the petitioner's
statement that this policy determination resulted in an expansion of
the scope of either the 2006 proposed rule or the 2009 final rule.
From its inception, the 2006 proposed cyber security rule would
have required licensees to protect those digital assets associated with
SSEP that, if compromised, could either directly or indirectly cause
radiological sabotage resulting in significant core damage or spent
fuel sabotage. As the Commission stated in SRM-COMWCO-10-0001, it ``has
determined as a matter of policy that the NRC's cyber security rule at
10 CFR 73.54 should be interpreted to include SSCs in the BOP that have
a nexus to radiological health and safety at NRC-licensed nuclear power
plants.'' In SECY-10-0153, ``Cyber Security--Implementation of the
Commission's Determination of Systems and Equipment within the Scope of
Title 10 of the Code of Federal Regulations, Section 73.54,'' dated
November 19, 2010, the staff informed the Commission that it considered
SSCs in the BOP that have a nexus to radiological health and safety to
be those that could, if compromised, directly or indirectly affect
reactivity of a nuclear power plant, and are therefore within the scope
[[Page 43603]]
of important-to-safety functions described in Sec. 73.54(a)(1).
To the extent that Assertion D raises issues concerning FERC's
jurisdiction at nuclear power plants, the NRC does not have the
authority to limit the jurisdiction granted to other agencies by
statute.
Assertion E in Section III of the PRM:
The petitioner states that, as of March 1, 2014, NRC inspections
had identified violations of low safety significance associated with
the failure of reactor licensees to identify digital assets needing
protection against cyber attacks under Sec. 73.54(a)(1). The
petitioner views the violations as an illustration of the problems
created by the Sec. 73.54(a)(1) scoping language. The petitioner
concludes that although these violations ``have little to no safety
significance,'' they have resulted in unnecessary expense and a
diversion of licensee resources, as well as conveying to the public
``an incorrect impression that the state of cyber security preparedness
at those sites is less than adequate.''
NRC Response to Assertion E:
The NRC agrees that several violations have been identified during
its inspections of licensee cyber security programs at reactor sites.
The implementation plan for licensees' cyber security programs, which
has eight distinct milestones, was developed to allow a phased approach
to full implementation of the cyber security requirements in Sec.
73.54. One of the goals of this phased approach was to allow lessons
learned to be applied by licensees prior to full program
implementation. The use of this phased approach was intended to
identify issues in an iterative way, particularly in regard to digital
asset identification. In cases where violations were identified during
cyber security inspections of milestones 1 through 7, the NRC performed
an evaluation and did not cite the violations if the licensee had made
a ``good faith'' effort to comply with the requirements. Licensees
addressed these issues and made corrections to their cyber security
programs prior to full program implementation. The identification and
resolution of these cyber security issues help ensure that licensees
successfully implement an effective cyber security program.
The NRC disagrees with the petitioner's assertion that the
violations illustrate problems with the scoping language in Sec.
73.54(a)(1). This scoping language correctly identifies the digital
computer and communication systems and networks that the Commission
intends licensees to protect against a cyber attack. The language in
Sec. 73.54(a)(1) does not identify specific digital assets that must
be protected by licensee cyber security programs. It is the
responsibility of the licensee to conduct the analysis required by
Sec. 73.54(b)(1) and correctly identify those digital assets that, if
compromised, could adversely impact SSEP functions. Failure to
correctly identify digital assets may result in violations of the NRC's
cyber security requirements.
The NRC also disagrees that the violations have conveyed to the
public an incorrect impression that the state of cyber security
preparedness at reactor sites is less than adequate. The petitioner
provides no evidence that the public has formed such an impression as a
result of these violations.
IV. Public Comments on the Petition
The comment period closed on December 8, 2014, and the NRC received
19 comment submissions on the PRM. All of the comment submissions
received on this petition are available on https://www.regulations.gov
under Docket ID NRC-2014-0165.
Of the 19 comment submissions received, 15 comment submissions
supported the petition, two opposed the petition, and two provided
other observations on the cyber security rule language. Overall, the
comments received do not present additional information to support the
petitioner's proposal that the NRC amend its cyber security
regulations. The NRC organized the 19 comment submissions into 18
comment categories that are summarized and evaluated in the following
paragraphs.
Comment Category 1: Scope of the rule language is too broad.
In support of the PRM, several comment submissions assert that the
scope of the existing cyber security requirements in Sec. 73.54 is too
broad. They contend that this broad scope has resulted in unnecessary
burden on reactor licensees having to maintain hundreds to thousands of
digital assets within their cyber security programs. The comment
submissions state that most of these digital assets have no nexus to
protecting the health and safety of the public. One commenter stated
that the high level of protection required by Sec. 73.54 should be
focused on the equipment whose compromise could endanger the health and
safety of the public. Another commenter stated that the regulations in
Sec. 73.54 now allow the NRC to require that licensees classify an
excessive number of components as ``critical'' even though their
functions have little or no bearing on nuclear safety.
NRC Response to Category 1 Comments: The comments included in
Category 1 reiterate assertions made in the petition that the scope of
the cyber security rule is too broad. For the reasons set forth in the
``Reasons for Denial'' section of this document, the NRC does not agree
with these comments.
The NRC also disagrees with the commenters' assertion that actions
required by Sec. 73.54 are overly burdensome and have no nexus to
protecting the health and safety of the public. As the Commission
stated in SRM-COMWCO-10-0001, it ``has determined as a matter of policy
that the NRC's cyber security rule at 10 CFR 73.54 should be
interpreted to include SSCs in the BOP that have a nexus to
radiological health and safety at NRC-licensed nuclear power plants.''
In SECY-10-0153, ``Cyber Security--Implementation of the Commission's
Determination of Systems and Equipment within the Scope of Title 10 of
the Code of Federal Regulations, Section 73.54,'' dated November 19,
2010, the Commission was informed that SSCs in the BOP that have a
nexus to radiological health and safety are those that could, if
compromised, directly or indirectly affect reactivity of a nuclear
power plant, and are therefore within the scope of important-to-safety
functions described in Sec. 73.54(a)(1).
Consistent with the NRC's cyber security rule, it is the licensee's
responsibility to analyze its digital computer and communication
systems and networks and identify those digital assets that could
adversely impact SSEP functions if compromised by a cyber attack. The
NRC agrees with the commenters that some licensees may have
conservatively identified certain digital assets that could not
adversely impact SSEP functions even if compromised as being within the
scope of the NRC's cyber security rule.
RG 5.71 contains NRC guidance for complying with the regulations in
Sec. 73.54. Licensees may use methods other than those described in RG
5.71 to meet the regulations in Sec. 73.54. The NRC has also engaged
with stakeholders regarding revisions to industry guidance to assist
licensees in better identifying digital assets that fall within the
scope of the NRC's cyber security rule. For example, as a result of
insights gained from these interactions, NEI revised NEI 08-09, ``Cyber
Security Plan for Nuclear Power Reactors,'' and NEI 13-10, ``Cyber
Security Control Assessment,'' to address the application of cyber
security controls for CDAs at nuclear power plants. Similarly, NEI
revised NEI 13-10, Revision 6, to address
[[Page 43604]]
scoping issues using a consequence-based approach for screening CDAs.
The consequence-based approach in NEI 13-10 enables industry to focus
resources on the more consequential digital assets that require
protection. The NRC continues to engage with stakeholders to review and
revise, as appropriate, relevant cyber security guidance, including
guidance on the scoping of CDAs.
Comment Category 2: Implementation costs are significantly higher
than those presented in the regulatory analysis for the 2009 rule.
Two comment submissions that support the PRM assert that the costs
associated with implementation of the cyber security requirements in
Sec. 73.54 are substantially higher than those presented in the NRC's
2009 regulatory analysis of these requirements.
NRC Response to Category 2 Comments: The NRC acknowledges that the
costs regarding the implementation of Sec. 73.54 were underestimated
in the 2009 regulatory analysis that supported the final rule.
Specifically, the quantity of digital assets identified as CDAs far
exceeded the NRC's estimates developed at the time the cyber security
rule was finalized. As noted previously, given that many licensees
adopted a conservative approach to identifying digital assets at their
facilities, the NRC has and is continuing to engage with stakeholders
to revise guidance for identifying CDAs. The NRC anticipates that this
will reduce the number of identified CDAs and result in a reduction of
costs to licensees in implementing the NRC's cyber security
requirements. As a separate effort, the NRC is reviewing its process
for developing cost estimates associated with rulemakings.
Comment Category 3: Unnecessary diversion of licensee resources and
attention.
The commenters assert that in determining required cyber security
controls, no graded approach is acceptable for use by NRC licensees in
complying with the requirements in Sec. 73.54. These commenters assert
that the cost of implementing and maintaining these controls contribute
no added value, are costly to maintain, and reduce the effectiveness of
the digital assets.
One commenter asserts that the current rule language significantly
increases costs by: (1) Creating a need for vendor processes outside of
a well-vetted procurement process; (2) imposing requirements for
monitoring and assessment outside of current practices; and (3) failing
to accept current maintenance rule analysis of a component's risk
significance for exemption from additional treatment. Two commenters
assert that the cost of implementing and maintaining the requirements
of the rule directly competes with the cost of facility modifications
that could improve plant safety, equipment reliability, and reduce the
likelihood of an initiating event. Another commenter states that the
scope of the existing requirements in Sec. 73.54 introduce significant
and unwarranted costs in terms of complying with the requirements in
Sec. 73.56, and that these issues would be resolved by granting the
PRM.
Two commenters suggest specific alternatives for refocusing the
rule language in Sec. 73.54. One commenter suggests, as an alternative
to the petitioner's suggested changes: (1) Modifying Sec.
73.54(a)(1)(i) to directly state that only ``Target Set and credited
security system equipment'' need special consideration for preventing
the previously established Sec. 73.1 DBT intent of radiological
sabotage; and (2) modifying Sec. 73.54(a)(1)(ii) to focus on trips and
transients created by cyber attacks initiated by outsiders external to
the Protected Area (PA). Another commenter similarly suggested that the
NRC refocus the rule language on: (1) High assurance protection for
preventing radiological sabotage; (2) preventing plant trips and
transients caused by cyber attacks initiated from outside the PA; and
(3) preventing accidental initiation of a cyber attack caused by
insider action.
NRC Response to Category 3 Comments: The NRC disagrees that a
graded approach is not acceptable for use by licensees in complying
with the requirements in Sec. 73.54. A consequence-based, graded
assessment process for identifying CDAs and determining the appropriate
security controls to be applied to those CDAs may contribute to
reducing unnecessary costs to licensees. Using this graded approach may
result in the application of certain minimum cyber security controls to
specifically identified CDAs as well as provide a method to assess
alternate means of protecting CDAs, for example EP CDAs, from cyber
attacks. However, this graded approach will still require that
licensees adequately protect CDAs from a cyber attack. For these
reasons and the reasons stated in the ``Reasons for Denial'' section of
this document, the NRC disagrees with the assertion that the
development of a consequence-based, graded approach for implementing
the requirements in Sec. 73.54 contributes no added value, and
therefore, results in the unnecessary expenditure of licensee
resources.
The NRC also disagrees with the assertion that the application of
cyber security controls reduces the effectiveness of digital assets.
The commenters did not provide any evidence to support this assertion.
The NRC is not aware of any operational experience or data that
demonstrates a reduction in effectiveness of digital assets due to the
application of cyber security controls to those assets.
The NRC does not agree that the rule language in Sec. 73.54
imposes requirements for monitoring and assessment that are ``outside
of current practices.'' The cyber security rule does not require any
change to existing licensee monitoring and assessment practices that
have already been implemented and does not impose any requirement that
licensees develop and implement new monitoring and assessment
practices.
The NRC disagrees with the comments regarding limiting the scope of
Sec. 73.54 to only target sets and credited security system equipment,
and trips and transients created by cyber attacks initiated by
outsiders external to the PA. Cyber attacks can adversely affect the
performance of SSEP functions of a nuclear facility, which are broader
than the functions performed by target sets and security system
equipment. As described in RG 5.71, the scope of the cyber security
rule goes beyond consideration of cyber attacks initiated by outsiders
external to the PA because a defense-in-depth approach requires the
licensee to evaluate threats from all possible vectors, including
internal and external threats. The NRC further notes that the
commenters did not provide a technical basis to support their
recommendations.
Certain Category 3 comments are outside the scope of the petition
for rulemaking. First, the comment that the requirements in Sec. 73.54
create a need for vendor processes outside of a well-vetted procurement
process is outside the scope of the petition. The petition does not
discuss the alleged need for additional vendor processes identified in
the comment submission. Additionally, the commenter did not provide any
evidence that the NRC's cyber security rule impacts licensee
procurement processes. Licensees may procure any computer systems,
networks or digital assets that enable them to comply with NRC
requirements and are not prohibited by federal law. The cyber security
rule requires licensees to ensure that CDAs associated with whatever
digital systems the licensee procures are adequately protected from a
cyber attack by the application of appropriate security
[[Page 43605]]
controls. Second, the assertion that the requirements in Sec. 73.54
fail to address the maintenance rule's analysis of a component's risk
significance is also outside the scope of the petition. The petition
does not discuss the application of the maintenance rule and its
discussion of a component's risk significance. Finally, the commenters
assertion that the requirements in Sec. 73.54 introduce significant
and unwarranted costs in terms of compliance with the access
authorization requirements in Sec. 73.56 are also outside the scope of
the petition. The petition does not discuss the impact of the cyber
security rule on access authorization requirements. Furthermore, the
rule does not limit licensees' ability to purchase any digital system
that helps it meet the NRC's access authorization requirements. The NRC
is not aware of any operational experience or data showing that
licensees have had significant and unwarranted costs that are unique to
compliance with access authorization requirements as a result of the
cyber security rule.
Comment Category 4: Issues with process for identification of CDAs.
In support of the PRM, several comment submissions assert that a
significant amount of resources are expended on protecting CDAs that
have no capability to cause core damage or spent fuel sabotage even if
compromised, and that these efforts result in no measurable increase in
reactor and spent fuel security. One commenter specifies in this regard
that each CDA requires documentation of an assessment as configured
against the cyber security technical controls in NEI 08-09, Revision 6,
Appendix D, ``even if the CDA has no capability to cause core damage or
spent fuel sabotage.'' Several comment submissions identify CDAs
associated with EP communication systems and other equipment as
examples of CDAs that should not be included in the scope of the cyber
security program. One commenter similarly states that the application
of cyber security controls to CDAs is not consistent with other
elements of the physical protection program, since cyber security
controls are required for systems and equipment that go beyond the
systems and equipment necessary to prevent radiological sabotage. One
commenter asserts that the resources expended on protecting these CDAs
may delay other facility enhancements that would protect more important
equipment.
One commenter further states that additional burden is added to
protect CDAs when the postulated attack is specific to an active
insider with physical CDA access. Two comment submissions cited the
Plant Process Computer (PPC) as an example of a system that should not
be subject to cyber security requirements.
NRC Response to Category 4 Comments: These comments reiterate
issues raised in the petition; the NRC does not agree with these
comments for the reasons stated in the ``Reasons for Denial'' section
of this document.
Regarding the comment that the application of cyber security
controls to CDAs for demonstrating compliance with the cyber security
requirements in Sec. 73.54 is not consistent with other elements of
the physical protection program, the commenter did not provide an
example that supports this assertion. Furthermore, the cyber security
requirements in Sec. 73.54 are not inconsistent with the physical
protection program performance objectives set forth in Sec. 73.55.
Specifically, there is no inconsistency as protecting against
radiological sabotage is not limited to protecting only those digital
assets the compromise of which can directly cause significant core
damage and spent fuel sabotage. Rather, protecting against radiological
sabotage involves protecting those digital assets that, if compromised
by a cyber attack, could either directly or indirectly cause
significant core damage or spent fuel sabotage. As noted previously,
the Commission included EP functions within the scope of the cyber
security rule because they are essential to mitigate the consequences
of radiological sabotage.
Regarding the comment on the need to assess CDAs that have no
capability to cause core damage or spent fuel sabotage even if
compromised, this essentially repeats assertions made in the petition.
The NRC does not agree that protecting against radiological sabotage is
limited to protecting only those digital assets that can directly cause
significant core damage or spent fuel sabotage if impacted by a cyber
attack.
The comments identify the PPC as an example of a system that should
not be subject to cyber security requirements. Consistent with Sec.
73.54(b)(1), a licensee must conduct a site-specific analysis to
identify those digital assets that meet the criteria of Sec.
73.54(a)(1) and must be protected from a cyber attack. Determining
whether or not the PPC should or should not be subject to the NRC's
cyber security requirements is dependent upon the outcome of the site-
specific analysis.
Comment Category 5: Benefits of granting the petition.
The comment submissions supporting the PRM generally assert that
granting the petition would: (1) Have an immediate positive impact on
overall safety and security while reducing unnecessary burden on
reactor licensees; (2) continue to provide defense-in-depth protection
for those digital assets having a nexus to radiological safety and
security, thereby eliminating the unnecessary diversion of attention
and resources expended on protecting digital assets that do not have a
nexus to radiological safety and security; and (3) be consistent with
the NRC's original intent to prevent radiological sabotage, in
accordance with long-standing physical protection program requirements.
Several comment submissions added that if the petition is granted, they
would still be able to meet the requirements in Sec. 73.54 to provide
high assurance of adequate protection from cyber attacks. Two comment
submissions assert that granting the petition would support grid
reliability through protection of digital assets capable of causing a
reactor trip, and they continue to support having the NRC as the single
regulatory authority for cyber security in order to enhance regulatory
clarity and implementation efficiency.
NRC Response to Category 5 Comments: For the reasons set forth in
response to petitioner's Assertion B, the NRC disagrees with the
commenters' assertion that the current version of the cyber security
rule is not consistent with the original intent of the rule.
Additionally, the NRC disagrees with the comments asserting that
the petitioner's proposed changes would have an immediate positive
impact on overall safety and security while reducing unnecessary burden
on reactor licensees. Instead, granting the petition would have the
opposite effect as it would increase the risk of SSEP functions being
compromised by a cyber attack.
The NRC also disagrees with the commenters' assertions that the
petitioner's proposed changes would continue to provide defense-in-
depth protection of digital assets (i.e., digital computer and
communication systems and networks). The NRC explained in the 2009 SOC
that as computer technology is increasingly integrated into nuclear
power plants, many plant safety and security systems rely on this
technology to carry out their functions. The digital assets associated
with these integrated systems must be protected to minimize potential
attack pathways and the consequences of a successful cyber attack.
Granting the petition would have the opposite effect as it would remove
[[Page 43606]]
cyber security protection for such digital assets and decrease defense-
in-depth, inconsistent with the rule. For example, the term ``defense-
in-depth'' used in Sec. 73.54(c)(2) requires that a cyber security
program be designed to apply and maintain ``defense-in-depth protective
strategies to ensure the capability to detect, respond to, and recover
from cyber attacks.'' In responding to a comment on what became Sec.
73.54(c)(2), the Commission in Section III.D of the 2009 SOC stated
that defense-in-depth for digital assets ``includes technical and
administrative controls that are integrated and used to mitigate
threats from identified risks'' (74 FR 13934; March 27, 2009).
To the extent that the comment submissions are asserting that the
NRC should be the single regulatory authority establishing cyber
security requirements for nuclear power plants, the NRC does not have
the authority to limit the jurisdiction granted to other agencies by
statute. However, the NRC has worked closely with FERC on matters of
mutual interest related to the nation's electric power grid reliability
and nuclear power plant safety and security, including but not limited
to, coordination of activities related to cyber security at nuclear
power plants. By the memorandum of agreement dated September 22, 2015,
the NRC and FERC have reached a mutual agreement on how each agency
will implement its jurisdiction over cyber security assets at nuclear
power plants.
Comment Category 6: Interpretation of ``Critical Digital Assets''
under the cyber security rule.
One commenter asserts that NRC inspectors have interpreted
``critical digital assets'' to include backup valve position indicators
to which an operator may refer during an abnormal plant condition. The
commenter states that if such indicators were affected by a cyber
security event, the required response action could be potentially
delayed but would not affect plant safety. The commenter concludes that
designating valve position indicators as CDAs ``adds hundreds of
components to the critical digital asset program'' without contributing
to plant safety and goes well beyond any reasonable definition of what
constitutes a ``critical'' digital asset.
NRC Response to Category 6 Comments: The subject of whether any
digital asset is a ``critical digital asset'' is based on a site-
specific analysis of digital assets performed by the licensee. RG 5.71,
``Cyber Security Program for Nuclear Facilities,'' NEI 08-09, ``Cyber
Security Plan for Nuclear Power Reactors,'' and NEI 13-10, ``Cyber
Security Control Assessment,'' provide guidance to licensees on the
development of licensee cyber security plans that meet NRC
requirements, including the process of identifying and implementing
appropriate cyber security controls for CDAs.
The NRC is continuing to engage with stakeholders to develop
guidance revisions to streamline the process for addressing the
application of cyber security controls to CDAs. For example, the NRC
has reviewed NEI proposals for risk-informing the identification of
CDAs for EP, BOP, important-to-safety and safety-related digital assets
(ADAMS Accession Nos. ML20129J981, ML20209A442, and ML20223A256). NEI
has stated its intent to incorporate these revisions into its guidance
documents and to submit them to the NRC for endorsement.
Comment Category 7: Critical Infrastructure Protection standards.
Two comment submissions assert that the evidence required by the
NRC and the North American Electric Reliability Corporation Critical
Infrastructure Protection standards regarding compliance with
cybersecurity requirements should be brought into closer alignment
through rulemaking to reduce the current burden on those utilities that
run both nuclear and non[hyphen]nuclear facilities. The comment
submissions further assert that Sec. 73.54 requires utilities to
comply with the requirements of multiple regulatory agencies and having
to provide different types of evidence to different agencies places
unnecessary burdens on the limited number of utility cybersecurity
professionals. One of these comment submissions also asserts that a
rulemaking should establish clear boundaries of jurisdiction between
the NRC and other regulatory agencies.
NRC Response to Category 7 Comments: These comments pertain to
issues that were not raised by the petitioner and, therefore, are
outside the scope of this PRM. The NRC's cyber security rule is
applicable only to NRC power reactor licensees and is not applicable to
non-nuclear electric utilities.
Further, to the extent that the comment submissions are asserting
that the NRC should establish clear boundaries to limit the
jurisdiction of other Federal regulatory agencies, the NRC has no
authority to limit the jurisdiction granted to other agencies by
statute. However, the NRC has worked closely with FERC on matters of
mutual interest related to the nation's electric power grid reliability
and nuclear power plant safety and security, including but not limited
to coordination of activities related to cyber security, to avoid dual
regulation of nuclear power plants. By the memorandum of agreement
dated September 22, 2015, the NRC and FERC have reached a mutual
agreement of how each agency will implement its jurisdiction over cyber
security assets at nuclear power plants.
Comment Category 8: The petition should be denied.
Two comment submissions assert that the petition should be denied.
The commenters assert that granting the petition would roll back
cybersecurity regulations essential for nuclear safety. The comment
submissions endorse maintaining a high level of cybersecurity
protection for both nuclear facilities and communication networks.
NRC Response to Category 8 Comments: The NRC agrees that the
petition should be denied. As discussed in the ``Reasons for Denial''
section of this document, the existing cyber security regulations in
Sec. 73.54 are necessary to ensure adequate protection of digital
computer and communication systems and networks associated with SSEP
functions and their related support systems.
Comment Category 9: Include PRM-proposed changes in the cyber
security event notification rulemaking.
Eleven comment submissions assert that the cyber security event
notification rulemaking could provide a ready vehicle for the changes
proposed in the petition.
NRC Response to Category 9 Comments: The Cyber Security Event
Notification final rule was published in the Federal Register on
November 2, 2015 (80 FR 67264). It was a separate action that did not
address the issues raised by the petitioner in PRM-73-18. These
comments are outside the scope of this PRM.
Comment Category 10: Specific examples of equipment that should not
be covered by the cyber security rule.
Nine comment submissions provide examples of equipment that should
not be required to be protected by the cyber security rule. Some of the
examples the commenters provide are digital process instruments within
BOP systems, wireless control systems associated with plant cranes,
non-safety related digital indicators, business computer systems, and
cameras, transmitters, and media converters.
NRC Response to Category 10 Comments: The issue of whether a
specific digital asset must be protected from cyber attacks under the
regulations in Sec. 73.54 is based on a site-specific analysis made by
the licensee. The NRC notes that, to address issues associated
[[Page 43607]]
with determining if certain equipment should be protected by the cyber
security rule, the NRC has found the guidance in NEI 13-10 and NEI 10-
04 to be acceptable for use in identifying systems and assets subject
to the cyber security rule. NEI 10-04 provides industry with a risk-
informed methodology for determining which digital assets should be
considered CDAs. NEI 13-10 provides guidance for developing a
consequence-based, graded approach to comply with the regulations in
Sec. 73.54. This approach provides for the application of certain
minimum cyber security controls to specifically identified CDAs, and a
method to assess alternate means for protecting certain classes of
equipment from cyber attack. Furthermore, the NRC has reviewed NEI
proposals for risk-informing the identification of CDAs for EP, BOP,
important-to-safety and safety-related digital assets. NEI has stated
its intent to incorporate these revisions into its guidance documents
and to submit them to the NRC for endorsement.
Comment Category 11: Suggested alternatives to granting the
petition.
Several comment submissions suggest the NRC should reassess the
adequacy of the cyber security rule and should work with external
stakeholders to consider other approaches such as a risk-informed,
graded approach, or international ISA99 industrial standards. Several
comment submissions provide specific examples of alternate approaches
to the cyber security rule. One commenter also asserts that concepts
such as redundancy, diversity, and common-cause failures should be
reexamined in the context of cyber security.
NRC Response to Category 11 Comments: In 2019, the NRC performed an
assessment of the Power Reactor Cyber Security Program. The program
assessment identified opportunities to further risk-inform the cyber
security guidance in lieu of pursuing changes to the cyber security
rule. For example, the NRC has reviewed NEI proposals for risk-
informing the identification of CDAs for EP, BOP, important-to-safety
and safety-related digital assets. NEI has stated its intent to
incorporate these revisions into its guidance documents and to submit
them to the NRC for endorsement.
Comment Category 12: NRC should impose additional requirements for
cyber security.
One commenter asserts that unintentional or non-malicious cyber
incidents are not adequately addressed in NRC guidance documents, and
that the NRC should have a requirement to include unintentional cyber
incidents. Also, the commenter asserts that engineers and technicians
that are experts in instrumentation and control (I&C), electrical
engineering, and plant maintenance should be part of the cyber security
team, and that the NRC should consider the use of digital I&C and
electrical systems for nuclear plant safety applications. The commenter
asserts that the training for engineers to be able to identify
potential cyber incidents is minimal, and that the current NRC
requirements for cyber security are not conservative when compared to
safety requirements.
NRC Response to Category 12 Comments: The NRC notes that the NRC's
cyber security requirements do not distinguish between intentional and
unintentional cyber attacks. Licensees are required to protect against
any cyber attack that could adversely impact critical digital assets
associated SSEP functions. The NRC's existing cyber security
regulations in Sec. 73.54 provide high assurance that digital computer
and communication systems and networks associated with SSEP functions
are protected against a cyber attack. The NRC's cyber security
framework also requires that the licensee's cyber security staff have
the appropriate training.
Comment Category 13: Examples of cyber security incidents that
illustrate need for more requirements.
One commenter who opposes the PRM asserts that the current NRC
cyber security requirements need to be strengthened, and that granting
the PRM would lessen protection against cyber attacks. The commenter
provides examples of cyber security incidents supporting his concern,
and further asserts that: (1) The NRC cyber security review of the
Oconee I&C upgrade was not adequate, and the NRC should accordingly
reassess the adequacy of the cyber security rule because control
systems are not adequately protected by the current scope of Sec.
73.54; (2) a comprehensive review is needed to understand the potential
system interactions of the different devices in a reactor facility's
safety and non-safety systems, and these system vulnerabilities should
be covered by Sec. 73.54; (3) air-gapped security measures are not
necessarily adequate since it is possible that a well-meaning insider
could unintentionally connect infected portable media to a plant system
or component, and the commenter provides examples of how a reactor
facility could be compromised using an unintentional insider as a
vector for a cyber attack; (4) integrity checking does not offer
protection against malicious manipulations until complemented with
authenticity checking; and (5) malware has been shown to affect certain
cyber vulnerable systems such as human machine interfaces that are used
in reactor facilities.
NRC Response to Category 13 Comments: The NRC agrees that granting
the PRM could lessen protection against cyber attacks. For the reasons
set forth in the ``Reasons for Denial'' section of this document, the
NRC has decided to deny the PRM. The commenter is requesting that the
NRC take action to strengthen its cyber security requirements to
increase protection of digital computer and communication systems and
networks at nuclear power plants. The NRC has determined that the
current cyber security requirements are robust and provide reasonable
assurance that critical digital assets are adequately protected to
prevent a cyber attack.
Comment Category 14: Specific Disagreement with petitioner's
changes.
Two comment submissions that oppose the PRM assert that the
petitioner's proposed changes do not adequately protect safety and
security of nuclear power plants, and that the petitioner's proposed
changes are not conservative. The comment submissions assert that cyber
threats to safety-related and important-to-safety functions can cause,
or contribute to, core melt scenarios. The comment submissions also
assert that a reduction in cyber security requirements for EP systems
is unacceptable because it would not then be possible to meet existing
regulations concerning notification of emergency responders if these
systems were compromised.
One commenter further asserts that limiting the Sec. 73.54
cybersecurity requirements to the prevention of significant core damage
and spent fuel sabotage would not provide effective protection for
other safety-critical systems. This commenter also asserts that only
the strongest, layered defenses are likely to discourage reconnaissance
and attack vector development, and that granting the PRM would (1)
eviscerate the NRC's strong cybersecurity regulations and technical
guidance; and, (2) exacerbate dependence of nuclear facilities on
offsite AC power, therefore producing greater exposure to long-term
loss of offsite power risks.
NRC Response to Category 14 Comments: The NRC generally agrees with
these comments. Cyber attacks on safety-related and important-to-safety
functions may cause, or contribute to, radiological sabotage (e.g.,
core melt scenarios). If the provisions in Sec. 73.54(a)(1)(iii)
(requiring the protection of digital computer and
[[Page 43608]]
communication systems and networks associated with EP functions,
including offsite communications) were removed as the PRM requests,
this would likely hamper a reactor licensee's ability to notify
emergency responders in the event that offsite communication systems
were compromised in a cyber attack.
The NRC assumes that the commenter's reference to ``layered
defenses'' refers to the concept of defense-in-depth. As discussed in
the response to the Category 5 Comments, the existing regulations in
Sec. 73.54 reflect a defense-in-depth approach, and the NRC agrees
that granting the PRM would not be consistent with maintaining defense-
in-depth.
Comment Category 15: RG 5.71 and NEI 08-09 should be reassessed.
Two comment submissions opposing the petition assert that the
current regulatory guidance is insufficient. The commenters assert that
neither RG 5.71 nor NEI 08-09 addresses cyber threats and
vulnerabilities that have been demonstrated to be exploitable, and that
the scope of RG 5.71 should be reassessed. One commenter also states
that the scope of RG 5.71 should be reassessed to better address
control system-specific cyber security issues. The commenters also
provide various examples of concerns regarding the current regulatory
guidance and specific suggestions for improving this guidance. The
commenters assert that the current interpretation of the cyber security
rule is increasing plant risk by reducing operational stability. The
commenters further assert that configuration changes prescribed by NEI
08-09 and RG 5.71 contribute to uncertainty in the reliability of CDAs.
The commenters assert that RG 5.71 should be updated to include
consideration of plant risk. One commenter asserts that the existing
guidance is too focused on information technology and ignores the
merits of current protective approaches that are based on traditional
I&C Engineering and other license requirements.
NRC Response to Category 15 Comments: These comments are beyond the
scope of the PRM. The petition does not raise the guidance issues
identified in the comment submissions. The NRC performs periodic
reviews of its guidance documents to determine if they need revision.
The results of the most recent periodic review of RG 5.71 can be found
under ADAMS Accession No. ML15099A158. The NRC disagrees that the
current interpretation of the cyber security rule is increasing plant
risk by reducing operational stability. The comment submissions did not
provide support for this assertion, and the NRC is not aware of any
such reduction in operational stability.
Comment Category 16: Existing plant processes are sufficient to
protect most digital equipment.
Two comment submissions that support the PRM assert that while
there are thousands of digital assets that are important to the
efficient operation of reactor facilities, such assets would be
adequately protected by the existing plant controls such as physical
protection, network isolation, configuration management, maintenance
and testing. One of the comment submissions adds that EP functionality
assets, such as communication systems, are typically protected using
redundancy and diversity.
NRC Response to Category 16 Comments: The NRC recognizes that there
may be large numbers of digital assets that are important to the
efficient operation at a nuclear power plant. These assets may well be
protected by existing plant controls. The NRC cyber security
requirements do not require the protection of such assets if they
cannot adversely impact SSEP functions even if they are compromised.
The NRC has determined that CDAs that can adversely impact SSEP
functions must be protected from a cyber attack. If a licensee's site-
specific analysis can demonstrate that existing plant controls at a
given nuclear power plant can protect these CDAs from a cyber attack,
then the licensee does not need to apply additional security controls
to meet the requirements of the NRC's cyber security rule. If existing
plant controls cannot provide such protection, then additional cyber
security controls for CDAs would be required.
Comment Category 17: Cyber Security Language was not offered for
public comment.
One commenter reiterates the petitioner's assertion that the 2006
proposed rule's scoping language (71 FR 62664; October 26, 2006) was
removed and replaced with new text in the 2009 final rule (74 FR 13926;
March 27, 2009), asserting that the practical effect of the new scoping
language was likely not clear when the final rule was issued.
NRC Response to Category 17 Comments: For the reasons stated in the
``Reasons for Denial'' section of this document, the NRC does not agree
with this comment. The clarifying changes made to the scoping language
in the 2009 final rule are consistent with and a logical outgrowth of
the proposed rule, and the reasons for making these changes were
adequately explained in the 2009 SOC.
Comment Category 18: NRC cyber security requirements should be
expanded.
One commenter suggested that in order to cover ``all digital assets
involved in the management of power-block industrial energy,'' the
scope of Sec. 73.54 should be expanded.
NRC Response to Category 18 Comments: The NRC assumes that in
referencing ``all digital assets involved in the management of power-
block industrial energy'' the commenter is referring to digital assets
or digital components used to support a reactor facility's on-site
power systems. Safety-related digital assets or safety-related digital
components interfacing with the facility's on-site power systems are
addressed in the safety requirements of 10 CFR part 50 (specifically in
appendix A to 10 CFR part 50, general design criterion 17). The
commenter does not provide a basis for expanding the scope of Sec.
73.54 to include matters relating to general design criterion 17.
V. Availability of Documents
The documents identified in the following table are available to
interested persons through one or more of the following methods, as
indicated.
------------------------------------------------------------------------
Adams Accession No.
Document Date or Federal Register
citation or website
------------------------------------------------------------------------
PRM-73-18--Petition to Amend 10 June 12, 2014... ML14184B120
CFR 73.54, ``Protection of
Digital Computer and
Communication Systems and
Networks'' submitted by
Nuclear Energy Institute (NEI).
Protection of Digital Computer September 22, 79 FR 56525
and Communication Systems and 2014.
Networks; Notice of Docketing
and Request for Comment.
[[Page 43609]]
PRM-73-18--Public Comments RE: August 10, 2020. ML20223A027
Protection of Digital Computer
and Communication Systems and
Networks.
SRM-CMWCO-10-0001--``Regulation October 21, 2010 ML102940009
of Cyber Security at Nuclear
Power Plants''.
Regulatory Guide 5.71, ``Cyber January 2010.... ML090340159
Security Program for Nuclear
Facilities''.
NEI 08-09, ``Cyber Security April 2010...... ML101180437
Plan for Nuclear Power
Reactors,'' Revision 6.
NEI 13-10, ``Cyber Security August 2017..... ML17234A615
Control Assessment,'' Revision
6,.
Regulatory Analysis and Backfit March 17, 2009.. ML083390372
Analysis; Final Rulemaking:
Power Reactor Security
Requirements.
GAO-15-98, NRC Needs to Improve December 12, https://www.gao.gov/
Its Cost Estimates by 2014. products/GAO-15-98
Incorporating More Best
Practices.
SECY-14-0002, ``Plan for January 17, 2014 ML13274A495
Updating the U.S. Nuclear
Regulatory Commission's Cost-
Benefit Guidance''.
NUREG/BR-0058, ``Regulatory April 2017...... ML17100A480
Analysis Guidelines of the
U.S. Nuclear Regulatory
Commission, Draft Report for
Comment,'' Revision 5.
MD 8.2, ``Management of September 20, ML18093B087
Backfitting, Forward Fitting, 2019.
Issue Finality, and
Information Requests''.
SECY-20-0008: Draft Final NUREG/ February 13, ML19261A277
BR-0058, Regulatory Analysis 2020.
Guidelines of the U.S. Nuclear.
Memorandum of Agreement between September 22, ML15033A181
the U.S. Nuclear Regulatory 2015.
Commission (NRC) and the
Federal Energy Regulatory
Commission (FERC).
SECY-14-0129: Rulemaking: Final November 20, ML14136A212
Rule: Cyber Security Event 2014.
Notification (CSEN).
Power Reactor Security March 27, 2009.. 74 FR 13926
Requirements; Final Rule.
Power Reactor Cyber Security July 12, 2019... ML19175A211
Program Assessment.
Periodic Review of RG 5.71..... April 9, 2015... ML15099A158
Draft Regulatory Guide (DG)- August 2018..... ML18016A129
5061, ``Cyber Security Program
for Nuclear Power Reactor''.
Power Reactor Security October 26, 2006 71 FR 62664
Requirements; Proposed Rule.
Cyber Security Event November 2, 2015 80 FR 67265
Notifications; Final Rule.
Memorandum of Understanding December 17, ML093510905
Between the U.S. Nuclear 2019.
Regulatory Commission and the
North American Electric
Reliability Corporation.
EA-02-026, Issuance of Order February 25, ML020510635
for Interim Safeguards and 2002.
Security Compensatory Measures
for Nuclear Power Plants.
EA-03-086, ``Issuance of Order April 29, 2003.. ML030740002
Requiring Compliance with
Revised Design Basis Threat
for Operating Power Reactors''.
SECY-10-0153, ``Cyber Security-- November 19, ML103490344
Implementation of the 2010.
Commission's Determination of
Systems and Equipment within
the Scope of Title 10 of the
Code of Federal Regulations,
Section 73.54''.
NEI 10-04, ``Identifying July 2012....... ML12180A081
Systems and Assets Subject to
the Cyber Security Rule, Rev.
2''.
------------------------------------------------------------------------
VI. Conclusion
For the reasons discussed in this document, the NRC finds that the
petitioner did not present sufficient new information to warrant the
requested changes in PRM-73-18. The NRC's current cyber security
requirements are consistent with the NRC's original intent for the
cyber security rule, and these requirements continue to provide
reasonable assurance of adequate protection of public health and
safety, and the common defense and security. Further, the NRC has
determined that the language in Sec. 73.54(a) is not overly broad.
Finally, the NRC has determined that existing and ongoing revisions to
guidance can effectively address the other issues raised by the
petitioner in this PRM without the need for rulemaking. Accordingly,
the NRC is denying the PRM-73-18.
Dated: August 3, 2021.
For the Nuclear Regulatory Commission.
Annette L. Vietti-Cook,
Secretary of the Commission.
[FR Doc. 2021-16889 Filed 8-9-21; 8:45 am]
BILLING CODE 7590-01-P