Discussion of

Draft Proposed Rule Text 

Fuel Cycle Cyber Secur

Public Meeting

Thursday May 19, 2016
Category 3 Meeting

Public participation is actively sought at todmeeting. The purpose of this meeting is to hdiscussions with stakeholders regarding the security proposed rulemaking for fuel cycle facilities. The handout provides the draft proposed ruand should be considered a work in progres
Agenda

• Introductions, status update, and timeline• Discuss draft proposed rule text• Discuss topics for the July 2016 public m
Status Update and Timelin

• Regulatory basis completed in Marc

(81 FR 21449)

• Two additional public meetings July 

(guidance), and August 2016 (guida

• Proposed rule due to the Commissio

March 17, 2017
Structure of

Draft Proposed Rule Tex

a) Applicabilityb) Cyber security program performance objecc) Consequences of concernd) Cyber security programe) Cyber security planf) Configuration managementg) Biennial review of the cyber security prograh) Event reporting and trackingi) Records
(a) Applicability

• Fuel cycle facilities – conversion, deconversion, enri

fuel fabrication, and reprocessing

• Date to submit cyber security plan as a license ame

request (e.g., 5 months after final rule)

• NRC reviews and approves cyber security plan (5 m

standard review time)

• Implementation of cyber security plan – phased app

under consideration:

– Vital digital assets identified (e.g., 4 months after NRC 

cyber security plan)

– Full implementation (e.g., 12 months after NRC appro

security plan)
(b) Cyber security progra

performance objectives

• Protect vital digital assets• Detect cyber attacks associated with a 

consequence of concern

• Respond to cyber attacks associated with 

consequence of concern

• Recover from cyber attacks associated w

consequence of concern
(c) Consequences of con

• Four types of consequences of concern

– Active - safety (applies to all facilities)– Latent - safety and security (applies to all facilities)– Latent - safeguards (applies to Category II facilities)– Latent - design basis threat (applies to Category I faci

• Intent is to prevent a cyber attack that:

– directly results in a safety consequence of concern (ac– compromises a function needed to prevent, mitigate, o

to a safety/security/safeguards/design basis threat eve

associated with a consequence of concern (latent)

• Consequence thresholds informed by existing re

requirements
(d) Cyber security progra

• Revised approach from a risk management framewo

consequence-based cyber security program

• (1) Establish a Cyber Security Team

– Management structure instead of authorizing official– Adequately staffed, trained, qualified, and equipped

• (2) Establish and maintain a set of cyber security co

each applicable type of consequence of concern

– Intent is for each facility to provide a set of controls for 

safety” and “Latent - safety and security”

– Other consequences of concern applicable only at cer

facilities (i.e., “Latent - safeguards” at Category II and design basis threat” at Category I)

– Address each control family (examples in draft regulat
(d) Cyber security progra

(contin

• (3) Identify digital assets and support syste

could result in a consequence of concern, if compromised

– Intent is to document these digital assets– Digital assets that are part of a classified sys

excluded

• (4) Determine vital digital assets

– Identified in (d)(3) but have no alternate mea– Alternate means must be protected from a cy

attack (examples will be in the draft regulator
(d) Cyber security progra

(contin

• (5) Validation testing for vital digital assets

– Confirms network location– Provides an established boundary for implem

controls

• (6) Implementing procedures for cyber secu

controls 

– Apply applicable controls to vital digital asset

those with no alternate means)

– Control parameters can be tailored to digital – Compensatory measures instead of plans of 

and milestones
(e) Cyber security plan

• Must be submitted for NRC review in accordanc

paragraph (a)

• (1) Considers site specific conditions

• (2) Documents the applicable sets of cyber sec

controls

• (3) Includes measures for incident response an

recovery (examples will be in the draft regulato

• (4) Supporting documentation maintained onsit
(f) Configuration manage

• Evaluate facility modifications to ensure 

performance objectives are met prior to operating associated digital assets

• A facility modification may:

– Add a previously unconsidered digital ass– Remove an alternate means for a digital a

that may create a vital digital asset requircyber security controls
(g) Biennial review of the 

security program

• Minimum 24 month review instead of an annual 

and 3-year reaccreditation

• No independent assessment required• Licensee documents, tracks, and addresses inte

findings, deficiencies, and recommendations thafrom:

– (1) Analysis of program effectiveness and 

adequateness;

– (2) Review of implementing procedures; and– (3) Vulnerability evaluation
(h) Event reporting and t

• Follow existing regulatory requirements for 

notifications to the NRC

• When known, inform the NRC that the notific

a result of a cyber attack

• 24 hour reportable for:

– (1) Failure, compromise, degradation, or vulner

a required cyber security control

– (2) Compromise of vital digital asset for nuclea

control and accounting at Category I or II facilitassociated regulatory requirement exists
(i) Records

• Retain supporting documentation as a re• Maintain records for inspection• Maintain superseded records for 3 years
Next Public Meetings

• July and August 2016 meetings• Both in Rockville, MD -- bridge lines will be prov• Suggested topics:

– NRC staff presents draft regulatory guide (Ju– Stakeholders provide initial feedback (July)– Seek additional stakeholder feedback on dra

regulatory guide (August)

• Any additional topics?