Voglio sapere a riguardo di…

jbell on DSKJLSW7X2PROD with PROPOSALS

Federal Register / Vol. 86, No. 151 / Tuesday, August 10, 2021 / Proposed Rules controls. Second, the assertion that the requirements in 73.54 fail to address the maintenance rules analysis of a components risk significance is also outside the scope of the petition. The petition does not discuss the application of the maintenance rule and its discussion of a components risk significance. Finally, the commenters assertion that the requirements in 73.54 introduce significant and unwarranted costs in terms of compliance with the access authorization requirements in 73.56
are also outside the scope of the petition. The petition does not discuss the impact of the cyber security rule on access authorization requirements.
Furthermore, the rule does not limit licensees ability to purchase any digital system that helps it meet the NRCs access authorization requirements. The NRC is not aware of any operational experience or data showing that licensees have had significant and unwarranted costs that are unique to compliance with access authorization requirements as a result of the cyber security rule.
Comment Category 4: Issues with process for identification of CDAs.
In support of the PRM, several comment submissions assert that a significant amount of resources are expended on protecting CDAs that have no capability to cause core damage or spent fuel sabotage even if compromised, and that these efforts result in no measurable increase in reactor and spent fuel security. One commenter specifies in this regard that each CDA requires documentation of an assessment as configured against the cyber security technical controls in NEI
0809, Revision 6, Appendix D, even if the CDA has no capability to cause core damage or spent fuel sabotage.
Several comment submissions identify CDAs associated with EP
communication systems and other equipment as examples of CDAs that should not be included in the scope of the cyber security program. One commenter similarly states that the application of cyber security controls to CDAs is not consistent with other elements of the physical protection program, since cyber security controls are required for systems and equipment that go beyond the systems and equipment necessary to prevent radiological sabotage. One commenter asserts that the resources expended on protecting these CDAs may delay other facility enhancements that would protect more important equipment.
One commenter further states that additional burden is added to protect CDAs when the postulated attack is
VerDate Sep<11>2014

16:29 Aug 09, 2021

Jkt 253001

specific to an active insider with physical CDA access. Two comment submissions cited the Plant Process Computer PPC as an example of a system that should not be subject to cyber security requirements.
NRC Response to Category 4
Comments: These comments reiterate issues raised in the petition; the NRC
does not agree with these comments for the reasons stated in the Reasons for Denial section of this document.
Regarding the comment that the application of cyber security controls to CDAs for demonstrating compliance with the cyber security requirements in 73.54 is not consistent with other elements of the physical protection program, the commenter did not provide an example that supports this assertion. Furthermore, the cyber security requirements in 73.54 are not inconsistent with the physical protection program performance objectives set forth in 73.55.
Specifically, there is no inconsistency as protecting against radiological sabotage is not limited to protecting only those digital assets the compromise of which can directly cause significant core damage and spent fuel sabotage. Rather, protecting against radiological sabotage involves protecting those digital assets that, if compromised by a cyber attack, could either directly or indirectly cause significant core damage or spent fuel sabotage. As noted previously, the Commission included EP functions within the scope of the cyber security rule because they are essential to mitigate the consequences of radiological sabotage.
Regarding the comment on the need to assess CDAs that have no capability to cause core damage or spent fuel sabotage even if compromised, this essentially repeats assertions made in the petition. The NRC does not agree that protecting against radiological sabotage is limited to protecting only those digital assets that can directly cause significant core damage or spent fuel sabotage if impacted by a cyber attack.
The comments identify the PPC as an example of a system that should not be subject to cyber security requirements.
Consistent with 73.54b1, a licensee must conduct a site-specific analysis to identify those digital assets that meet the criteria of 73.54a1 and must be protected from a cyber attack.
Determining whether or not the PPC
should or should not be subject to the NRCs cyber security requirements is dependent upon the outcome of the sitespecific analysis.
Comment Category 5: Benefits of granting the petition.

PO 00000

Frm 00007

Fmt 4702

Sfmt 4702

43605

The comment submissions supporting the PRM generally assert that granting the petition would: 1 Have an immediate positive impact on overall safety and security while reducing unnecessary burden on reactor licensees; 2 continue to provide defense-in-depth protection for those digital assets having a nexus to radiological safety and security, thereby eliminating the unnecessary diversion of attention and resources expended on protecting digital assets that do not have a nexus to radiological safety and security; and 3 be consistent with the NRCs original intent to prevent radiological sabotage, in accordance with long-standing physical protection program requirements. Several comment submissions added that if the petition is granted, they would still be able to meet the requirements in 73.54 to provide high assurance of adequate protection from cyber attacks. Two comment submissions assert that granting the petition would support grid reliability through protection of digital assets capable of causing a reactor trip, and they continue to support having the NRC as the single regulatory authority for cyber security in order to enhance regulatory clarity and implementation efficiency.
NRC Response to Category 5
Comments: For the reasons set forth in response to petitioners Assertion B, the NRC disagrees with the commenters assertion that the current version of the cyber security rule is not consistent with the original intent of the rule.
Additionally, the NRC disagrees with the comments asserting that the petitioners proposed changes would have an immediate positive impact on overall safety and security while reducing unnecessary burden on reactor licensees. Instead, granting the petition would have the opposite effect as it would increase the risk of SSEP
functions being compromised by a cyber attack.
The NRC also disagrees with the commenters assertions that the petitioners proposed changes would continue to provide defense-in-depth protection of digital assets i.e., digital computer and communication systems and networks. The NRC explained in the 2009 SOC that as computer technology is increasingly integrated into nuclear power plants, many plant safety and security systems rely on this technology to carry out their functions.
The digital assets associated with these integrated systems must be protected to minimize potential attack pathways and the consequences of a successful cyber attack. Granting the petition would have the opposite effect as it would remove
E:FRFM10AUP1.SGM

10AUP1