Cyber Security for Byproduct Materials Licensees, 22413-22414 [2018-10358]

Agencies

• NUCLEAR REGULATORY COMMISSION

[Federal Register Volume 83, Number 94 (Tuesday, May 15, 2018)]
[Proposed Rules]
[Pages 22413-22414]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-10358]


========================================================================
Proposed Rules
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains notices to the public of 
the proposed issuance of rules and regulations. The purpose of these 
notices is to give interested persons an opportunity to participate in 
the rule making prior to the adoption of the final rules.

========================================================================


Federal Register / Vol. 83, No. 94 / Tuesday, May 15, 2018 / Proposed 
Rules

[[Page 22413]]



NUCLEAR REGULATORY COMMISSION

10 CFR Part 37

[NRC-2015-0019]
RIN 3150-AJ56


Cyber Security for Byproduct Materials Licensees

AGENCY: Nuclear Regulatory Commission.

ACTION: Discontinuation of rulemaking activity.

-----------------------------------------------------------------------

SUMMARY: The U.S. Nuclear Regulatory Commission (NRC) is discontinuing 
the rulemaking activity that would have developed cyber security 
requirements for byproduct materials licensees possessing risk-
significant quantities of radioactive materials. The purpose of this 
action is to inform members of the public of the discontinuation of the 
rulemaking activity and to provide a brief discussion of the NRC's 
decision. The rulemaking activity will no longer be reported in the 
NRC's portion of the Unified Agenda of Regulatory and Deregulatory 
Actions (the Unified Agenda).

DATES: As of May 15, 2018, the rulemaking activity discussed in this 
document is discontinued.

ADDRESSES: Please refer to Docket ID NRC-2015-0019 when contacting the 
NRC about the availability of information regarding this action. You 
may obtain publicly available information related to this document 
using any of the following methods:
     Federal Rulemaking website: Go to https://www.regulations.gov and search for Docket ID NRC-2015-0019. Address 
questions about NRC dockets to Carol Gallagher; telephone: 301-415-
3463; email: [email protected]. For technical questions, contact 
the individual listed in the FOR FURTHER INFORMATION CONTACT section of 
this document.
     NRC's Agencywide Documents Access and Management System 
(ADAMS): You may obtain publicly-available documents online in the 
ADAMS Public Documents collection at https://www.nrc.gov/reading-rm/adams.html. To begin the search, select ``ADAMS Public Documents'' and 
then select ``Begin Web-based ADAMS Search.'' For problems with ADAMS, 
please contact the NRC's Public Document Room (PDR) reference staff at 
1-800-397-4209, 301-415-4737, or by email to [email protected]. The 
ADAMS accession number for each document referenced (if it is available 
in ADAMS) is provided the first time that it is mentioned in the 
SUPPLEMENTARY INFORMATION section.
     NRC's PDR: You may examine and purchase copies of public 
documents at the NRC's PDR, Room O1F21, One White Flint North, 11555 
Rockville Pike, Rockville, Maryland 20852.

FOR FURTHER INFORMATION CONTACT: Vanessa Cox, Office of Nuclear 
Material Safety and Safeguards, U.S. Nuclear Regulatory Commission, 
Washington, DC 20555-0001; telephone: 301-415-8342; email: 
[email protected].

SUPPLEMENTARY INFORMATION: 

I. Discussion

    The NRC and Agreement States are responsible for overseeing and 
implementing the National Materials Program to enable the safe and 
secure use of radioactive materials licensed for commercial, 
industrial, academic, and medical uses. The program includes thousands 
of byproduct materials licensees in varying operating environments, 
ranging from small industrial radiography and well-logging businesses 
to large manufacturing facilities, universities, and medical 
facilities. The majority of the licensees that possess risk-significant 
quantities of radioactive materials are regulated by Agreement States. 
Risk-significant quantities of radioactive material are defined as 
those meeting the thresholds for Category 1 and Category 2 included in 
appendix A to part 37 of title 10 of the Code of Federal Regulations 
(10 CFR), ``Physical Protection of Category 1 and Category 2 Quantities 
of Radioactive Material.''
    In a Commission paper, SECY-12-0088, ``The Nuclear Regulatory 
Commission Cyber Security Roadmap,'' dated June 25, 2012 (ADAMS 
Accession No. ML12135A050), the NRC staff described its plan to 
evaluate the need for cyber security requirements for NRC and Agreement 
State licensees and facilities, including byproduct materials 
licensees. As described in that paper, the NRC staff planned to form a 
working group, with Agreement State participation, to develop self-
assessment tools for licensees and conduct a limited number of site 
visits. Based on the results of these assessments and site visits, the 
working group intended to prepare a paper outlining potential actions 
for Commission consideration.
    In July 2013, the NRC established the Byproduct Materials Cyber 
Security Working Group, comprised of headquarters and regional NRC 
staff and representation from the Organization of Agreement States. The 
purpose of the working group was to identify potential cyber security 
vulnerabilities among commercial, medical, industrial, and academic 
users of risk-significant radioactive materials and determine if the 
results warranted regulatory action. The working group worked with the 
NRC's Intelligence Liaison and Threat Assessment Branch, which 
regularly monitors the threats associated with cyber security and 
shares cyber threat information with licensees, as appropriate.
    The working group identified four sets of digital assets that the 
NRC should evaluate with respect to cyber threat protection:
    (1) Digital/microprocessor-based systems and devices that support 
the physical security of the licensee's facilities. These include 
access control systems, physical intrusion detection and alarm systems, 
video camera monitoring systems, digital video recorders, door alarms, 
motion sensors, keycard readers, and biometric scanners;
    (2) Equipment and devices with software-based control, operation, 
and automation features, such as panoramic irradiators and gamma 
knives;
    (3) Computers and systems used to maintain source inventories, 
audit data, and records necessary for compliance with security 
requirements and regulations; and
    (4) Digital technology used to support incident response 
communications and coordination such as digital packet radio systems, 
digital repeater stations, and digital trunk radio systems.
    On January 6, 2016, the NRC staff submitted a memorandum to the

[[Page 22414]]

Commission titled ``Staff Activities Related to the Evaluation of 
Materials Cyber Security Vulnerabilities'' (ADAMS Accession No. 
ML15201A509). This memorandum informed the Commission of the ongoing 
evaluation to determine the cyber security risk to each of the four 
sets of digital assets for risk-significant radioactive materials 
licensees, and described the two-pronged approach focused on 
information gathering and consequence analysis that was used.
    As part of the information gathering effort, the NRC staff 
distributed a voluntary survey, ``Questionnaire on Cyber Security at 
Byproduct Materials Licensees'' (ADAMS Accession No. ML15246A306) on 
April 29, 2016, to all NRC and Agreement State licensees that possessed 
Category 1 and 2 quantities of radioactive materials. The purpose of 
the questionnaire was to identify what key digital assets existed at 
each licensee type, how they were connected to internal/external 
networks and the internet, and what technical and procedural security 
measures were in place for protection and operation of these systems 
and devices. The NRC staff also conducted outreach to stakeholders to 
encourage completion of the questionnaire, and site visits to 
manufacturers and panoramic irradiator licensees.
    The consequence analysis was conducted in parallel with the 
information gathering effort, and evaluated the potential for onsite 
and offsite consequences that could occur if the availability, 
integrity, or confidentiality of data or systems associated with 
nuclear materials were compromised by a cyber attack.
    Given the regulatory responsibilities of the U.S. Food and Drug 
Administration (FDA), the NRC limited its evaluation of the software 
systems used in medical applications to the systems related to the 
radiation safety and physical protection authority of the NRC. The NRC 
has a memorandum of understanding with the FDA that clarifies the 
respective roles of each agency in regulating the safe use of 
radiopharmaceuticals and sealed sources, and other medical devices 
containing radioactive material (ADAMS Accession No. ML023520399). 
Additional information on the FDA's activities, role, and expectations 
for the continued cyber security of medical devices can be found at 
https://www.fda.gov/downloads/medicaldevices/digitalhealth/ucm544684.pdf.
    On February 28, 2017, the NRC staff provided an update to the 
Commission on the status of agency activities pertaining to cyber 
security at licensee facilities in a Commission paper, SECY-17-0034, 
``Update to the U.S. Nuclear Regulatory Commission Cyber Security 
Roadmap'' (ADAMS Accession No. ML16354A258). The update noted the NRC 
staff's further consideration of cyber security requirements for 
radioactive materials licensees since the January 2016 memorandum. 
Additionally, the paper stated that the working group planned to 
complete its evaluation of the questionnaire responses, consequence 
analysis, and any follow-up communication with stakeholders and develop 
recommendations for a path forward.
    Subsequently, the NRC completed its evaluation of cyber security 
requirements for byproduct materials licensees in October 2017.
    The NRC staff concluded that byproduct materials licensees that 
possess risk-significant quantities of radioactive material do not rely 
solely on digital assets to ensure safety or physical protection. 
Rather, these licensees generally use a combination of measures, such 
as doors, locks, barriers, human resources, and operational processes, 
to ensure security, which reflects a defense-in-depth approach to 
physical protection and safety. As a result, the staff concluded that a 
compromise of any of the digital assets identified in the January 6, 
2016, Commission memorandum would not result in a direct dispersal of 
risk-significant quantities of radioactive material, or exposure of 
individuals to radiation, without a concurrent and targeted breach of 
the physical protection measures in force for these licensees.
    Therefore, the NRC staff determined that the current cyber security 
threat and potential consequences do not warrant regulatory action. 
However, the NRC staff determined that it would be prudent to issue an 
Information Notice (IN) to communicate effective practices for cyber 
security to byproduct materials licensees possessing risk-significant 
quantities of radioactive material. The IN will provide licensees with 
a better understanding of contemporary cyber security issues and 
strategies to protect digital assets (e.g., computers, digital alarm 
systems), including those used to facilitate compliance with physical 
security requirements, such as those in 10 CFR part 37. The IN, which 
will reference existing cyber security guidance developed by the NRC's 
Office of Nuclear Reactor Regulation and other Federal agencies, will 
be issued later in 2018.

II. Conclusion

    For the reasons discussed in this document, the NRC is 
discontinuing rulemaking activity to develop cyber security 
requirements for byproduct materials licensees possessing risk-
significant quantities of radioactive materials. In the next edition of 
the Unified Agenda, the NRC will update the entry for this rulemaking 
activity and refer to this document to indicate that the rulemaking has 
been discontinued. This rulemaking activity will appear in the 
``Completed Actions'' section of the next edition of the Unified 
Agenda, but will not appear in future editions. If the NRC decides to 
pursue similar or related rulemaking activities in the future, it will 
inform the public through a new rulemaking entry in the Unified Agenda.

    Dated at Rockville, Maryland, this 10th day of May, 2018.

    For the Nuclear Regulatory Commission.
Victor McCree,
Executive Director for Operations.
[FR Doc. 2018-10358 Filed 5-14-18; 8:45 am]
 BILLING CODE 7590-01-P