The Nuclear Regulatory Commission’s (NRC’s) Assistant Inspector General for Audits issued a memorandum on August 20 on the status of recommendations based on the Office of Inspector General’s (OIG’s) Audit of NRC’s Cyber Security Inspections at Nuclear Power Plants (OIG-19-A-13). As previously reported on Up & Atom, OIG recommended that the NRC work to close the critical skill gap for future cybersecurity inspection staffing, and develop and implement cybersecurity performance measures for licensees to use to demonstrate sustained program effectiveness. Based on the NRC’s July 3, 2019, response, OIG has issued this status of recommendations.
Following the July 12, 2019, release of “Power Reactor Cyber Security Program Assessment,” the Nuclear Regulatory Commission’s (NRC’s) Director of Physical and Cyber Security Policy in the Office of Nuclear Security and Incident Response issued a memorandum to NRC Staff on August 6, 2019.
The memorandum provides guidance to Staff on next steps, but also cautions that when initiating changes to the Cyber Security Program they keep several points in mind. Specifically, the Director asks Staff to ensure that changes do not adversely impact other areas of the program; that guidance revisions are consistent and incorporated throughout all documents; that, where necessary, a backfit analysis is performed; and that no changes constitute an unreasonable risk to public health and safety.
The memorandum reminds Staff that their next step, per the assessment, is to present a draft action plan by September 20, 2019. The action plan should identify enhancements to the Cyber Security Program that promote regulatory efficiency and effectiveness, while continuing to provide for reasonable assurance of public health and safety and promote common defense and security. The memorandum also praises NRC Staff for its efforts in conducting the assessment.
We will continue to monitor developments for cybersecurity at the NRC.
On July 25, 2019, the United States Government Accountability Office (GAO) released GAO-19-384, a report to congressional requesters analyzing the cybersecurity risk management of 23 civilian agencies—including the Nuclear Regulatory Commission (NRC). Using key elements such as risk tolerance and risk mitigation strategies, GAO examined the extent to which all agencies established a cybersecurity risk management program; what challenges, if any, agencies identified in developing and implementing such programs; and what steps the Office of Management and Budget (OMB) and the US Department of Homeland Security (DHS) have taken to meet their risk management responsibilities to address any challenges agencies face in this area. In its analysis, GAO compared policies and procedures from the 23 civilian agencies to key federal cybersecurity risk management practices, attained the agencies’ own views on challenges they faced, identified and analyzed actions taken by the OMB and DHS to determine whether such actions address agency challenges, and interviewed responsible agency officials.
The Ohio House of Representatives approved HB 6 on July 23, providing up to $150 million in financial support for the two operating nuclear plants in the state. A version of the House bill was passed by the Ohio Senate last week, and Governor Mike DeWine signed the bill into law shortly after the legislation passed the House.
On June 24, the US Supreme Court issued its opinion in Food Marketing Institute v. Argus Leader Media, expanding the scope of information protected under Exemption 4 of the Freedom of Information Act (FOIA). FOIA establishes an expansive right for the public to access records from executive agencies to hold the government accountable. Limiting that broad right, FOIA includes several broadly worded exceptions whereby the release of certain information may not be compelled under FOIA. One such exemption, Exemption 4, states that “trade secrets and commercial or financial information obtained from a person” that are “privileged or confidential” are protected from mandatory public disclosure. The statute does not define “confidential,” so the question of what “commercial or financial information” is protected from disclosure has resulted in much litigation.
Justice Gorsuch’s majority opinion held that commercial or financial information that is both customarily and actually treated as private by its owner—and that is provided to the government under an assurance of privacy—is exempt from disclosure under FOIA. This holding has significant implications for all businesses that turn any information over to the US government. No longer may courts require proof that the information, if disclosed, would “cause substantial harm” to the company’s competitive position. Mere confidentiality, plus agency representations that the information will remain confidential, is enough.
The Environmental Protection Agency (EPA) issued three rules on June 19, granting additional powers to states to determine their projected energy resource mixes, including nuclear energy. In response to the rules, utilities should be prepared for possible changes to state policies defining what constitutes “clean” energy and supporting reliability. The rules are intended to go into effect 30 days from their issuance. However, the implementation timeline for the rules is not certain because several states and organizations have stated they intend to challenge the rules in the federal courts.
Staff members from the US Nuclear Regulatory Commission’s (NRC’s) Office of Nuclear Security and Incident Response and Office of Nuclear Reactor Regulation held a public meeting on June 17 to discuss a summary of the Assessment of the NRC’s Power Reactor Cyber Security Program. In response to the Nuclear Energy Institute’s (NEI’s) PRM-73-18, “Petition to Amend 10 CFR 73.54, ‘Protection of Digital Computer and Communication Systems and Networks’,” and based on NRC guidance, this Assessment marked 10 years since the publication of 10 CFR 73.54.