Document Headings

                    Document headings vary by document type but may contain                    the following:                  
                -                       the agency or agencies that issued and signed a document                    
                -                       the number of the CFR title and the number of each part                      the document amends, proposes to amend, or is directly                      related to                    
                -                       the agency docket number / agency internal file number                    
                -                       the RIN which identifies each regulatory action listed in                      the Unified Agenda of Federal Regulatory and Deregulatory                      Actions                    

                    See the                                          Document Drafting Handbook                                        for more details.                  

###### Nuclear Regulatory Commission

          - [NRC-2021-0143]

# AGENCY:

Nuclear Regulatory Commission.

# ACTION:

Draft regulatory guide; request for comment.

# SUMMARY:

The U.S. Nuclear Regulatory Commission (NRC) is issuing for public comment a draft regulatory guide (DG), DG-5061, Revision 1, “Cyber Security Programs for Nuclear Power Reactors.” DG 5061, Revision 1, incorporates reference to industry whitepapers on identifying safety, important to safety, balance of plant, and emergency preparedness Critical Digital Assets. It also clarifies guidance on defense-in-depth for cyber security and includes updated text based on the latest National Institute of Standards and Technology (NIST) and International Atomic Energy Agency cyber security guidance. Specifically, this proposed revision clarifies issues identified from cyber security inspections, insights gained through the Security Frequently Asked Questions (SFAQ) process, documented cyber security attacks, new technologies, and new regulations. This proposed revision also considers the changes in the most recent revision to the NIST Special Publications (SP) 800-53, upon which Revision 0 of Regulatory Guide (RG) 5.71, “Cyber Security Programs for Nuclear Facilities” was based.

# DATES:

Submit comments by May 2, 2022. Comments received after this date will be considered if it is practical to do so, but the NRC is able to ensure consideration only for comments received on or before this date.

# ADDRESSES:

You may submit comments by any of the following methods; however, the NRC encourages electronic comment submission through the Federal Rulemaking Website:
      -  Federal Rulemaking Website:                          Go to                          https://www.regulations.gov                          and search for Docket ID NRC-2021-0143. Address questions about Docket IDs in                          Regulations.gov                          to Stacy Schumann; telephone: 301-415-0624; email:                          Stacy.Schumann@nrc.gov . For technical questions, contact the individuals listed in the                          FOR FURTHER INFORMATION CONTACT                          section of this document.                    
      -  Mail comments to:                          Office of Administration, Mail Stop: TWFN-7-A60M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN: Program Management, Announcements and Editing Staff.                    

                        For additional direction on obtaining information and submitting comments, see “Obtaining Information and Submitting Comments” in the                         **SUPPLEMENTARY INFORMATION**                         section of this document.                    

# FOR FURTHER INFORMATION CONTACT:

                        Kim Lawson-Jenkins, Office of Nuclear Security and Incident Response, telephone: 301-287-3656, email:                         *Kim.Lawson-Jenkins@nrc.gov*                         and Mekonen Bayssie, Office of Nuclear Regulatory Research, telephone: 301-415-1699, email:                         *Mekonen.Bayssie@nrc.gov*. Both are staff of the U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.                    

# SUPPLEMENTARY INFORMATION:

## I. Obtaining Information and Submitting Comments

### A. Obtaining Information

Please refer to Docket ID NRC-2021-0143 when contacting the NRC about the availability of information for this action. You may obtain publicly available information related to this action by any of the following methods:
    -  Federal Rulemaking Website:                      Go to                      https://www.regulations.gov                      and search for Docket ID NRC-2021-0143.                
    -  NRC's Agencywide Documents Access and Management System (ADAMS):                      You may obtain publicly available documents online in the ADAMS Public Documents collection at                      https://www.nrc.gov/​reading-rm/​adams.html . To begin the search, select “Begin Web-based ADAMS Search.” For problems with ADAMS, please contact the NRC's Public Document Room (PDR) reference staff at 1-800-397-4209, 301-415-4737, or by email to                      PDR.Resource@nrc.gov . The ADAMS accession number for each document referenced (if it is available in ADAMS) is provided the first time that it is mentioned in this document.                
    -  NRC's PDR:                      You may examine and purchase copies of public documents, by appointment, at the NRC's PDR, Room P1 B35, One White Flint North, 11555 Rockville Pike, Rockville, Maryland 20852. To make an appointment to visit the PDR, please send an email to                      PDR.Resource@nrc.gov                      or call 1-800-397-4209 or 301-415-4737, between 8:00 a.m. and 4:00 p.m. (ET), Monday through Friday, except Federal holidays.                

### B. Submitting Comments

                    The NRC encourages electronic comment submission through the Federal Rulemaking Website (                    *https://www.regulations.gov*). Please include Docket ID NRC-2021-0143 in your comment submission.                

                    The NRC cautions you not to include identifying or contact information that you do not want to be publicly disclosed in your comment submission. The NRC will post all comment submissions at                     *https://www.regulations.gov*                     as well as enter the comment submissions into ADAMS. The NRC does not routinely edit comment submissions to remove identifying or contact information.                

                    If you are requesting or aggregating comments from other persons for submission to the NRC, then you should inform those persons not to include identifying or contact information that they do not want to be publicly disclosed in their comment submission. Your request should state that the NRC                           ( print page 12209)                        does not routinely edit comment submissions to remove such information before making the comment submissions available to the public or entering the comment into ADAMS.                

## II. Additional Information

The NRC is issuing for public comment a DG in the NRC's “Regulatory Guide” series. This series was developed to describe and make available to the public information regarding methods that are acceptable to the NRC staff for implementing specific parts of the agency's regulations, to explain techniques that the staff uses in evaluating specific issues or postulated events, and to describe information that the staff needs in its review of applications for permits and licenses.

                    The DG, entitled “Cyber Security Programs for Nuclear Power Reactors,” is temporarily identified by its task number, DG-5061, Revision 1 (ADAMS Accession No. ML21095A329) is a proposed revision to RG 5.71, “Cyber Security Programs for Nuclear Facilities.” It provides NRC licensees with guidance on meeting the cyber security requirements described in section 73.54 of title 10 of the                     *Code of Federal Regulations*                     (10 CFR), “Protection of digital computer and communication systems and networks.”                

The staff is also issuing for public comment a draft regulatory analysis (ADAMS Accession No. ML21130A636). The staff developed the regulatory analysis to assess the value of revising RG 5.71 as well as alternative courses of action.

DG-5061, Revision 1, clarifies issues identified from cyber security inspections, insights gained through the SFAQ process, lessons learned from international and domestic cyber security attacks, new technologies, and new regulations. In addition, it considers changes in NIST SP 800-53, upon which Revision 0 of RG 5.71 was based. In 2010, the Commission issued Staff Requirements Memorandum (SRM), SRM-COMWCO-10-0001 (ADAMS Accession No. ML102940009) which clarified the scope of the cyber security rule regarding balance of plant (BOP) systems. This proposed revision to RG 5.71 includes guidance for structures, systems, and components in the BOP systems.

## III. Backfitting, Forward Fitting, and Issue Finality

DG-5061, Revision 1, if finalized, would revise RG 5.71, which describes methods acceptable for use by nuclear power plant licensees in meeting the requirements for the cyber security requirements in 10 CFR 73.54. Issuance of DG-5061 Revision 1, if finalized, would not constitute backfitting as defined in 10 CFR 50.109, “Backfitting,” and as described in NRC Management Directive (MD) 8.4, “Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests”; constitute forward fitting as that term is defined and described in MD 8.4; or affect the issue finality of any approval issued under 10 CFR part 52, “Licenses, certifications, and approvals for nuclear power plants.” As explained in DG-5061 Revision 1, applicants and licensees would not be required to comply with the positions set forth in DG-5061.

## IV. Submitting Suggestions for Improvement of Regulatory Guides

                    A member of the public may, at any time, submit suggestions to the NRC for improvement of existing RGs or for the development of new RGs. Suggestions can be submitted on the NRC's public website at                     *https://www.nrc.gov/​reading-rm/​doc-collections/​reg-guides/​contactus.html*. Suggestions will be considered in future updates and enhancements to the “Regulatory Guide” series.                

Dated: February 28, 2022.

For the Nuclear Regulatory Commission.

Meraj Rahimi,

Chief, Regulatory Guide and Programs Management Branch, Division of Engineering, Office of Nuclear Regulatory Research.

[FR Doc. 2022-04464 Filed 3-2-22; 8:45 am]

BILLING CODE 7590-01-P