The USA Cyber Security Project Team met in Richland, Washington in early April to continue their work on implementing the requirements of Nuclear Energy Institute 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors. The team covered many topics during the meeting. The topics included:
- Cyber Security Event Notification, Regulation Guide 5.83.
- 2015 USA peer assessment schedule.
- Current status and outstanding issues with the development of Type 2 Direct Impact Critical Digital Assets in NEI 13-10, Revision 2
- Methodology for crediting the Insider Mitigation Program.
- Integration into the Supply Chain process from qualified vendor to receipt inspection.
The event notification rule requires one hour notifications, four hour notifications, eight hour notifications and 24 hour recordable requirements based on the severity of the cyber incident.
Currently, each plant has reporting responsibilities in Operations and Security areas.
The USA Cyber Security Project Team will develop standard language for identifying when a cyber incident has occurred that will start the clock for reporting based on the final rules.
The USA team wants to streamline the response regarding the reporting to the NRC to ensure the USA nuclear plants are fully supporting the reporting requirements.
The anticipated release of the new rule is June 30 with implementation by year end.
“We have a lot of work to do to support the new Cyber Security notification rule, but I am confident we will be able to work together to reach a consensus,” said Jesse Smith, USA project manager.
Pictured from left to right are: (front row) Dave Feitl, Xcel; Gary Moore, Columbia; James Shank, PSEG; Peter Bruley, Xcel; Pam Frey, PPL; Michelle Hellmen, STP; Barbara Weber, Xcel; and Larry Tremonit, FERMI. Second row: Phil Hastings, PSEG; H. Joe Garry, Columbia; Kevin Sykes, Columbia; Richard Dewhurst, Cooper; Charles Suhr, Cooper; Doug Washington, AEP; Dean Kovacs, Columbia; Jesse Smith, USA project manager; and Jay Amin, Comanche Peak.